PT-2020-3689 · Squid+8 · Squid+9
Alex Rousskov
+1
·
Published
2020-06-30
·
Updated
2024-06-15
·
CVE-2020-15049
CVSS v3.1
9.9
Critical
| Vector | AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N |
Name of the Vulnerable Software and Affected Versions
Squid versions prior to 4.12
Squid versions 5.x prior to 5.0.3
Description
An issue in the http/ContentLengthInterpreter.cc component of Squid allows for a Request Smuggling and Poisoning attack against the HTTP cache. This can be achieved by sending an HTTP request with a Content-Length header containing specific characters, such as "+-" or uncommon shell whitespace character prefixes to the length field-value. The attack can be exploited by a remote attacker to poison the cache content using a specially crafted HTTP(S) request.
Recommendations
For Squid versions prior to 4.12, update to version 4.12 or later to resolve the issue.
For Squid versions 5.x prior to 5.0.3, update to version 5.0.3 or later to resolve the issue.
As a temporary workaround, consider restricting access to the http/ContentLengthInterpreter.cc component until a patch is available.
Fix
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Linuxmint
Red Hat
Rocky Linux
Squid
Squid Cache
Suse
Ubuntu