CVE-2019-12854 Affecting squid package, versions <7:4.11-3.module+el8.3.0+7819+eb7d4ef6


Severity

Recommended
medium

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.63% (80th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE8-SQUID-2572072
  • published10 Apr 2022
  • disclosed15 Aug 2019

Introduced: 15 Aug 2019

CVE-2019-12854  (opens in a new tab)

How to fix?

Upgrade Oracle:8 squid to version 7:4.11-3.module+el8.3.0+7819+eb7d4ef6 or higher.
This issue was patched in ELSA-2020-4743.

NVD Description

Note: Versions mentioned in the description apply only to the upstream squid package and not the squid package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it.

CVSS Scores

version 3.1