HTTP Request Smuggling Affecting squid package, versions <4.9-1


Severity

Recommended
0.0
medium
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
1.04% (85th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN13-SQUID-5696274
  • published10 Nov 2019
  • disclosed26 Nov 2019

Introduced: 10 Nov 2019

CVE-2019-18678  (opens in a new tab)
CWE-444  (opens in a new tab)

How to fix?

Upgrade Debian:13 squid to version 4.9-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream squid package and not the squid package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon.

CVSS Scores

version 3.1