PT-2020-2567 · Squid+7 · Squid+8

Regis Leroy · Published 2020-02-04 · Updated 2024-06-15 · CVE-2020-8449

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Squid versions prior to 4.10

Description The issue exists due to insufficient input validation in the Squid proxy server, allowing a remote attacker to disclose protected information by interpreting crafted HTTP requests in unexpected ways, potentially accessing server resources that are prohibited by earlier security filters.

Recommendations For Squid versions prior to 4.10, update to version 4.10 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive server resources to minimize the risk of exploitation.

Fix

Exposure of Resource to Wrong Sphere

RCE

Weakness Enumeration

CWE-668

CWE-20

Related Identifiers

ALSA-2020:4743

ALT-PU-2020-1479

ALT-PU-2020-1494

BDU:2020-02596

CESA-2020_4082

CESA-2020_4743

CVE-2020-8449

DLA-2278-1

DSA-4682-1

MGASA-2020-0106

OPENSUSE-SU-2020:0307-1

OPENSUSE-SU-2020:0606-1

OPENSUSE-SU-2020_0307-1

OPENSUSE-SU-2020_0606-1

OPENSUSE-SU-2024:11403-1

RHSA-2020:4082

RHSA-2020:4743

RHSA-2020_4082

RHSA-2020_4743

RLSA-2020:4743

SUSE-SU-2020:0487-1

SUSE-SU-2020:0493-1

SUSE-SU-2020:0661-1

SUSE-SU-2020:14460-1

USN-4289-1

Affected Products

Alt Linux

Almalinux

Centos

Red Hat

Rocky Linux

Squid

Squid Cache

Suse

Ubuntu

References · 161

• https://bdu.fstec.ru/vul/2020-02596 · Security Note
• http://squid-cache.org/Versions/v3/3.5/changesets/SQUID-2020_1.patch · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0661-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0106 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4289-1 · Vendor Advisory
• http://squid-cache.org/Versions/v4/changesets/squid-4-b3a0719affab099c684f1cd62b79ab02816fa962.patch · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-8449 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:14460-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2020-4743.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-8449 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8449 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8517 · Vendor Advisory
• http://squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-8e657e835965c3a011375feaa0359921c5b3e2dd.patch · Vendor Advisory
• http://squid-cache.org/Advisories/SQUID-2020_1.txt · Vendor Advisory