Ubuntu update for squid3

Published: 2020-08-27 | Updated: 2025-04-23

Risk	Medium
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2019-12520 CVE-2019-12523 CVE-2019-12524 CVE-2019-18676
CWE-ID	CWE-20 CWE-306
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Ubuntu Operating systems & Components / Operating system squid (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU27668

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-12520

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cache poisoning.

The vulnerability exists due to insufficient validation of user-supplied input within ESI. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows an attacker to gain access to features that only reverse proxies can use, such as ESI.

Mitigation

Update the affected package squid3 to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 18.04

squid (Ubuntu package): before 3.5.12-1ubuntu7.13

CPE2.3

External links

https://ubuntu.com/security/notices/USN-4446-2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU22908

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-12523

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input when processing URIs. A remote authenticated attacker can add certain characters to the URI, bypass implemented security restrictions and access restricted websites.

Mitigation

Update the affected package squid3 to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 18.04

squid (Ubuntu package): before 3.5.12-1ubuntu7.13

CPE2.3

External links

https://ubuntu.com/security/notices/USN-4446-2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Missing Authentication for Critical Function

EUVDB-ID: #VU27669

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-12524

CWE-ID: CWE-306 - Missing Authentication for Critical Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the url_regex check, and gain access to the blocked resource.

Mitigation

Update the affected package squid3 to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 18.04

squid (Ubuntu package): before 3.5.12-1ubuntu7.13

CPE2.3

External links

https://ubuntu.com/security/notices/USN-4446-2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU22909

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-18676

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing URIs. A remote attacker can create a specially crafted link, trick the victim into visiting it, trigger buffer overflow and crash the Squid process.

Mitigation

Update the affected package squid3 to the latest version.

Vulnerable software versions

Ubuntu: 16.04 - 18.04

squid (Ubuntu package): before 3.5.12-1ubuntu7.13

CPE2.3

External links

https://ubuntu.com/security/notices/USN-4446-2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.