HTTP Request Smuggling Affecting squid package, versions <7:4.11-3.module+el8.3.0+7819+eb7d4ef6


Severity

Recommended
0.0
medium
0
10

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
1.04% (85th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE8-SQUID-2574510
  • published10 Apr 2022
  • disclosed26 Nov 2019

Introduced: 26 Nov 2019

CVE-2019-18678  (opens in a new tab)
CWE-444  (opens in a new tab)

How to fix?

Upgrade Oracle:8 squid to version 7:4.11-3.module+el8.3.0+7819+eb7d4ef6 or higher.
This issue was patched in ELSA-2020-4743.

NVD Description

Note: Versions mentioned in the description apply only to the upstream squid package and not the squid package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon.

CVSS Scores

version 3.1