-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: squid security update Advisory ID: RHSA-2020:4082-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:4082 Issue date: 2020-09-30 CVE Names: CVE-2019-12528 CVE-2020-8449 CVE-2020-8450 CVE-2020-15049 CVE-2020-15810 CVE-2020-15811 CVE-2020-24606 ==================================================================== 1. Summary: An update for squid is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: HTTP Request Smuggling could result in cache poisoning (CVE-2020-15810) * squid: HTTP Request Splitting could result in cache poisoning (CVE-2020-15811) * squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528) * squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449) * squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450) * squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049) * squid: Improper input validation could result in a DoS (CVE-2020-24606) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the squid service will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1798534 - CVE-2019-12528 squid: Information Disclosure issue in FTP Gateway 1798540 - CVE-2020-8449 squid: Improper input validation issues in HTTP Request processing 1798552 - CVE-2020-8450 squid: Buffer overflow in reverse-proxy configurations 1852550 - CVE-2020-15049 squid: Request smuggling and poisoning attack against the HTTP cache 1871700 - CVE-2020-15810 squid: HTTP Request Smuggling could result in cache poisoning 1871702 - CVE-2020-15811 squid: HTTP Request Splitting could result in cache poisoning 1871705 - CVE-2020-24606 squid: Improper input validation could result in a DoS 6. Package List: Red Hat Enterprise Linux Server (v. 7): Source: squid-3.5.20-17.el7_9.4.src.rpm ppc64: squid-3.5.20-17.el7_9.4.ppc64.rpm squid-debuginfo-3.5.20-17.el7_9.4.ppc64.rpm squid-migration-script-3.5.20-17.el7_9.4.ppc64.rpm ppc64le: squid-3.5.20-17.el7_9.4.ppc64le.rpm squid-debuginfo-3.5.20-17.el7_9.4.ppc64le.rpm squid-migration-script-3.5.20-17.el7_9.4.ppc64le.rpm s390x: squid-3.5.20-17.el7_9.4.s390x.rpm squid-debuginfo-3.5.20-17.el7_9.4.s390x.rpm squid-migration-script-3.5.20-17.el7_9.4.s390x.rpm x86_64: squid-3.5.20-17.el7_9.4.x86_64.rpm squid-debuginfo-3.5.20-17.el7_9.4.x86_64.rpm squid-migration-script-3.5.20-17.el7_9.4.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: squid-debuginfo-3.5.20-17.el7_9.4.ppc64.rpm squid-sysvinit-3.5.20-17.el7_9.4.ppc64.rpm ppc64le: squid-debuginfo-3.5.20-17.el7_9.4.ppc64le.rpm squid-sysvinit-3.5.20-17.el7_9.4.ppc64le.rpm s390x: squid-debuginfo-3.5.20-17.el7_9.4.s390x.rpm squid-sysvinit-3.5.20-17.el7_9.4.s390x.rpm x86_64: squid-debuginfo-3.5.20-17.el7_9.4.x86_64.rpm squid-sysvinit-3.5.20-17.el7_9.4.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: squid-3.5.20-17.el7_9.4.src.rpm x86_64: squid-3.5.20-17.el7_9.4.x86_64.rpm squid-debuginfo-3.5.20-17.el7_9.4.x86_64.rpm squid-migration-script-3.5.20-17.el7_9.4.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: squid-debuginfo-3.5.20-17.el7_9.4.x86_64.rpm squid-sysvinit-3.5.20-17.el7_9.4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-12528 https://access.redhat.com/security/cve/CVE-2020-8449 https://access.redhat.com/security/cve/CVE-2020-8450 https://access.redhat.com/security/cve/CVE-2020-15049 https://access.redhat.com/security/cve/CVE-2020-15810 https://access.redhat.com/security/cve/CVE-2020-15811 https://access.redhat.com/security/cve/CVE-2020-24606 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBX3QtetzjgjWX9erEAQg6Kg/+IjZvYJWFZPsjuipp00D5fEzLb2tXh2rk u7qhrtBg6TGcLZW86dcPZ6kvSg4pbiaf9z7Z8sycabiUNLQXTBCZhDmZj1/w/6Ks 6OpY7iZ4Hz1D++a0q8xFAYPBHKuFRVdo7yADh5VTSBbtaa6dnGLuCpvL2PzKetr6 oa4rbG6wJzOIGFou4Adh0vgtHaX9avAeuR42MwLZhZN94wPHyiBR8giD97n1oivg nn8/WjHSZ8fJIncEETji+q7Wa3qx6vY/lYzRmeMS2OOCImLbSLOnBpaacd9IVjIJ DuDvf76h5lJWyeVfNyQeU4MRWqJXlCVy06CSEe47Q5mmE/A9aOmh4+J90NRV/GJR jvwD5sFx5P9GT9aIY5sOKdiXxmW+4G98Hw+LOF+P/Wwh3iX0UtJ6txjpigCTgc4y UV0caaoXFKHa/trMDwrSnHb4+Zls8YYBcJ0i2e0eN6k9VO0wNi88CxB7oiyrttZc sit0SI088joASEUUGHdEe9+7P0MwNLpO86ZrKCuUSxaCV8Kp4difzCbVOLHDzARw +vPMP5Komq4gS179emcJxZWTA1HC3Lj55wA2E2AiRgHaovQT2J3lYlTTfQr8alSn 7w8vw8Qew2YbYMnP5XZugrMJyFwE4dQAwnyN0QSVNmxSWMcxXgQPlr1bHgqKvxuM KY9kKOT+vkYC6v -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce