CVE-2020-8449

NameCVE-2020-8449
DescriptionAn issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4682-1
NVD severitymedium
Debian Bugs950802

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
squid (PTS)buster4.6-1+deb10u1vulnerable
buster (security)4.6-1+deb10u2fixed
bullseye4.11-2fixed
sid4.11-5fixed
squid3 (PTS)jessie3.4.8-6+deb8u5vulnerable
jessie (security)3.4.8-6+deb8u9vulnerable
stretch (security), stretch3.5.23-5+deb9u1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
squidsource(unstable)4.10-1950802
squidsourcebuster4.6-1+deb10u2DSA-4682-1
squid3source(unstable)(unfixed)

Notes

http://www.squid-cache.org/Advisories/SQUID-2020_1.txt
http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2020_1.patch (Squid 3.5)
http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_1.patch (Squid 4.8 and older)
http://www.squid-cache.org/Versions/v4/changesets/squid-4-b3a0719affab099c684f1cd62b79ab02816fa962.patch (Squid 4.9)

Search for package or bug name: Reporting problems