Improper Neutralization of Special Elements in Output Used by a Downstream Component in Squid - CVE-2019-18860

Vulnerability identifier: #VU27677

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-18860

CWE-ID: CWE-74

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform cache poisoning attack.

The vulnerability exists due to improper input validation of HTML code within the hostname parameter in cachemgr.cgi. A remote attacker can send a specially crated HTTP request and poison the cache.

Squid
Debian Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Opensuse
Oracle Solaris
squid3 (Ubuntu package)
squid (Ubuntu package)
libecap
libecap-devel
squid (Debian package)
squid

Install updates from vendor's website.

Squid - update to 4.9
squid3 (Ubuntu package) - addressed in versions 3.5.12-1ubuntu7.11, 3.5.27-1ubuntu1.6
squid (Ubuntu package) - addressed in versions 4.8-1ubuntu2.3, 4.10-1ubuntu1.1
libecap - update to 1.0.1-2
libecap-devel - update to 1.0.1-2
squid (Debian package) - update to 4.6-1+deb10u3
squid - update to 4.11-4
Oracle Solaris - addressed in versions 11.3 ESU 36.35, 11.4 SRU 89

• https://github.com/squid-cache/squid/pull/504
• https://github.com/squid-cache/squid/pull/505

• Cache poisoning in Squid
• OpenSUSE Linux update for squid
• Ubuntu update for Squid
• Red Hat Enterprise Linux 8 update for the squid:4 module
• Debian update for squid
• Anolis OS update for squid:4 (Anolis OS 8.4) module
• Multiple vulnerabilities in Oracle Solaris