VulnerabilityModified
CVE-2019-18677
An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions).
MEDIUM 6.1EPSS 7.24%
Does this matter?
Lower severity and a low EPSS score (7.24%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 7.24% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- squid-cache/squid · canonical/ubuntu linux · fedoraproject/fedora
- Source
- cve@mitre.org
References
- http://www.squid-cache.org/Advisories/SQUID-2019_9.txtThird Party Advisory
- http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-e5f1813a674848dde570f7920873e1071f96e0b4.patchRelease Notes
- http://www.squid-cache.org/Versions/v4/changesets/squid-4-36492033ea4097821a4f7ff3ddcb971fbd1e8ba0.patchRelease Notes
- https://bugzilla.suse.com/show_bug.cgi?id=1156328Issue Tracking, Third Party Advisory
- https://github.com/squid-cache/squid/pull/427Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/12/msg00011.htmlThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/
- https://usn.ubuntu.com/4213-1/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4682
- http://www.squid-cache.org/Advisories/SQUID-2019_9.txtThird Party Advisory
- http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-e5f1813a674848dde570f7920873e1071f96e0b4.patchRelease Notes
- http://www.squid-cache.org/Versions/v4/changesets/squid-4-36492033ea4097821a4f7ff3ddcb971fbd1e8ba0.patchRelease Notes
- https://bugzilla.suse.com/show_bug.cgi?id=1156328Issue Tracking, Third Party Advisory
- https://github.com/squid-cache/squid/pull/427Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/12/msg00011.htmlThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/
- https://usn.ubuntu.com/4213-1/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4682
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.