Security update for squid SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:2089-2 Final 1 1 2019-08-08T09:51:19Z current 2019-08-08T09:51:19Z 2019-08-08T09:51:19Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for squid This update for squid fixes the following issues: Security issue fixed: - CVE-2019-12529: Fixed a potential denial of service associated with HTTP Basic Authentication credentials (bsc#1141329). - CVE-2019-12525: Fixed a denial of service during processing of HTTP Digest Authentication credentials (bsc#1141332). - CVE-2019-13345: Fixed a cross site scripting vulnerability via user_name or auth parameter in cachemgr.cgi (bsc#1140738). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2019-2089,SUSE-2019-2089,SUSE-OpenStack-Cloud-Crowbar-8-2019-2089,SUSE-Storage-5-2019-2089 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20192089-2/ Link for SUSE-SU-2019:2089-2 https://lists.suse.com/pipermail/sle-security-updates/2019-August/005827.html E-Mail link for SUSE-SU-2019:2089-2 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1140738 SUSE Bug 1140738 https://bugzilla.suse.com/1141329 SUSE Bug 1141329 https://bugzilla.suse.com/1141332 SUSE Bug 1141332 https://www.suse.com/security/cve/CVE-2019-12525/ SUSE CVE CVE-2019-12525 page https://www.suse.com/security/cve/CVE-2019-12529/ SUSE CVE CVE-2019-12529 page https://www.suse.com/security/cve/CVE-2019-13345/ SUSE CVE CVE-2019-13345 page HPE Helion OpenStack 8 SUSE Enterprise Storage 5 SUSE OpenStack Cloud Crowbar 8 squid-3.5.21-26.17.1 squid-3.5.21-26.17.1 as a component of HPE Helion OpenStack 8 squid-3.5.21-26.17.1 as a component of SUSE Enterprise Storage 5 squid-3.5.21-26.17.1 as a component of SUSE OpenStack Cloud Crowbar 8 An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote (which would satisfy its requirements), leading to a memcpy of its length minus 1. CVE-2019-12525 HPE Helion OpenStack 8:squid-3.5.21-26.17.1 SUSE Enterprise Storage 5:squid-3.5.21-26.17.1 SUSE OpenStack Cloud Crowbar 8:squid-3.5.21-26.17.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192089-2/ https://www.suse.com/security/cve/CVE-2019-12525.html CVE-2019-12525 https://bugzilla.suse.com/1141332 SUSE Bug 1141332 An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages. CVE-2019-12529 HPE Helion OpenStack 8:squid-3.5.21-26.17.1 SUSE Enterprise Storage 5:squid-3.5.21-26.17.1 SUSE OpenStack Cloud Crowbar 8:squid-3.5.21-26.17.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192089-2/ https://www.suse.com/security/cve/CVE-2019-12529.html CVE-2019-12529 https://bugzilla.suse.com/1141329 SUSE Bug 1141329 The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter. CVE-2019-13345 HPE Helion OpenStack 8:squid-3.5.21-26.17.1 SUSE Enterprise Storage 5:squid-3.5.21-26.17.1 SUSE OpenStack Cloud Crowbar 8:squid-3.5.21-26.17.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192089-2/ https://www.suse.com/security/cve/CVE-2019-13345.html CVE-2019-13345 https://bugzilla.suse.com/1140738 SUSE Bug 1140738