========================================================================== Ubuntu Security Notice USN-4551-1 September 28, 2020 squid3 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Squid. Software Description: - squid3: Web proxy cache server Details: Alex Rousskov and Amit Klein discovered that Squid incorrectly handled certain Content-Length headers. A remote attacker could possibly use this issue to perform an HTTP request smuggling attack, resulting in cache poisoning. (CVE-2020-15049) Amit Klein discovered that Squid incorrectly validated certain data. A remote attacker could possibly use this issue to perform an HTTP request smuggling attack, resulting in cache poisoning. (CVE-2020-15810) RĂ©gis Leroy discovered that Squid incorrectly validated certain data. A remote attacker could possibly use this issue to perform an HTTP request splitting attack, resulting in cache poisoning. (CVE-2020-15811) Lubos Uhliarik discovered that Squid incorrectly handled certain Cache Digest response messages sent by trusted peers. A remote attacker could possibly use this issue to cause Squid to consume resources, resulting in a denial of service. (CVE-2020-24606) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: squid 3.5.27-1ubuntu1.9 Ubuntu 16.04 LTS: squid 3.5.12-1ubuntu7.15 In general, a standard system update will make all the necessary changes. References: https://usn.ubuntu.com/4551-1 CVE-2020-15049, CVE-2020-15810, CVE-2020-15811, CVE-2020-24606 Package Information: https://launchpad.net/ubuntu/+source/squid3/3.5.27-1ubuntu1.9 https://launchpad.net/ubuntu/+source/squid3/3.5.12-1ubuntu7.15