Security update for squid SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:2471-1 Final 1 1 2020-09-03T07:03:15Z current 2020-09-03T07:03:15Z 2020-09-03T07:03:15Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for squid This update for squid fixes the following issues: - CVE-2020-24606: Fix livelocking in peerDigestHandleReply (bsc#1175671). - CVE-2020-15811: Improve Transfer-Encoding handling (bsc#1175665). - CVE-2020-15810: Enforce token characters for field-name (bsc#1175664). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2020-2471,SUSE-2020-2471,SUSE-OpenStack-Cloud-7-2020-2471,SUSE-OpenStack-Cloud-8-2020-2471,SUSE-OpenStack-Cloud-9-2020-2471,SUSE-OpenStack-Cloud-Crowbar-8-2020-2471,SUSE-OpenStack-Cloud-Crowbar-9-2020-2471,SUSE-SLE-SAP-12-SP2-2020-2471,SUSE-SLE-SAP-12-SP3-2020-2471,SUSE-SLE-SAP-12-SP4-2020-2471,SUSE-SLE-SERVER-12-SP2-2020-2471,SUSE-SLE-SERVER-12-SP2-BCL-2020-2471,SUSE-SLE-SERVER-12-SP3-2020-2471,SUSE-SLE-SERVER-12-SP3-BCL-2020-2471,SUSE-SLE-SERVER-12-SP4-LTSS-2020-2471,SUSE-Storage-5-2020-2471 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20202471-1/ Link for SUSE-SU-2020:2471-1 https://lists.suse.com/pipermail/sle-security-updates/2020-September/007341.html E-Mail link for SUSE-SU-2020:2471-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1175664 SUSE Bug 1175664 https://bugzilla.suse.com/1175665 SUSE Bug 1175665 https://bugzilla.suse.com/1175671 SUSE Bug 1175671 https://www.suse.com/security/cve/CVE-2020-15810/ SUSE CVE CVE-2020-15810 page https://www.suse.com/security/cve/CVE-2020-15811/ SUSE CVE CVE-2020-15811 page https://www.suse.com/security/cve/CVE-2020-24606/ SUSE CVE CVE-2020-24606 page HPE Helion OpenStack 8 SUSE Enterprise Storage 5 SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE OpenStack Cloud 7 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 squid-3.5.21-26.32.1 squid-3.5.21-26.32.1 as a component of HPE Helion OpenStack 8 squid-3.5.21-26.32.1 as a component of SUSE Enterprise Storage 5 squid-3.5.21-26.32.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL squid-3.5.21-26.32.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS squid-3.5.21-26.32.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL squid-3.5.21-26.32.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS squid-3.5.21-26.32.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS squid-3.5.21-26.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 squid-3.5.21-26.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 squid-3.5.21-26.32.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 squid-3.5.21-26.32.1 as a component of SUSE OpenStack Cloud 7 squid-3.5.21-26.32.1 as a component of SUSE OpenStack Cloud 8 squid-3.5.21-26.32.1 as a component of SUSE OpenStack Cloud 9 squid-3.5.21-26.32.1 as a component of SUSE OpenStack Cloud Crowbar 8 squid-3.5.21-26.32.1 as a component of SUSE OpenStack Cloud Crowbar 9 An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream. CVE-2020-15810 HPE Helion OpenStack 8:squid-3.5.21-26.32.1 SUSE Enterprise Storage 5:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP3-BCL:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP3-LTSS:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP4-LTSS:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:squid-3.5.21-26.32.1 SUSE OpenStack Cloud 7:squid-3.5.21-26.32.1 SUSE OpenStack Cloud 8:squid-3.5.21-26.32.1 SUSE OpenStack Cloud 9:squid-3.5.21-26.32.1 SUSE OpenStack Cloud Crowbar 8:squid-3.5.21-26.32.1 SUSE OpenStack Cloud Crowbar 9:squid-3.5.21-26.32.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202471-1/ https://www.suse.com/security/cve/CVE-2020-15810.html CVE-2020-15810 https://bugzilla.suse.com/1175664 SUSE Bug 1175664 An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches. CVE-2020-15811 HPE Helion OpenStack 8:squid-3.5.21-26.32.1 SUSE Enterprise Storage 5:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP3-BCL:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP3-LTSS:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP4-LTSS:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:squid-3.5.21-26.32.1 SUSE OpenStack Cloud 7:squid-3.5.21-26.32.1 SUSE OpenStack Cloud 8:squid-3.5.21-26.32.1 SUSE OpenStack Cloud 9:squid-3.5.21-26.32.1 SUSE OpenStack Cloud Crowbar 8:squid-3.5.21-26.32.1 SUSE OpenStack Cloud Crowbar 9:squid-3.5.21-26.32.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202471-1/ https://www.suse.com/security/cve/CVE-2020-15811.html CVE-2020-15811 https://bugzilla.suse.com/1175665 SUSE Bug 1175665 Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF. CVE-2020-24606 HPE Helion OpenStack 8:squid-3.5.21-26.32.1 SUSE Enterprise Storage 5:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP2-BCL:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP2-LTSS:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP3-BCL:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP3-LTSS:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server 12 SP4-LTSS:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:squid-3.5.21-26.32.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:squid-3.5.21-26.32.1 SUSE OpenStack Cloud 7:squid-3.5.21-26.32.1 SUSE OpenStack Cloud 8:squid-3.5.21-26.32.1 SUSE OpenStack Cloud 9:squid-3.5.21-26.32.1 SUSE OpenStack Cloud Crowbar 8:squid-3.5.21-26.32.1 SUSE OpenStack Cloud Crowbar 9:squid-3.5.21-26.32.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202471-1/ https://www.suse.com/security/cve/CVE-2020-24606.html CVE-2020-24606 https://bugzilla.suse.com/1175671 SUSE Bug 1175671