CVE-2019-12525

An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote (which would satisfy its requirements), leading to a memcpy of its length minus 1.

References

Affected packages

Git / github.com/squid-cache/squid

Affected ranges

Type

GIT

Repo

https://github.com/squid-cache/squid

Events

Introduced

83f1f03412750fdd98b5219ff5829cd4e319a1b3

Last affected

6cfeb300caf423ff49a0511d8bd43a56f3418273

Introduced

Last affected

2e17b02616d37206ba9cccc53c20667624fbef9f

Database specific

{
    "versions": [
        {
            "introduced": "3.3.9"
        },
        {
            "last_affected": "3.5.28"
        },
        {
            "introduced": "4.0"
        },
        {
            "last_affected": "4.7"
        }
    ]
}

Affected versions

Other

HISTORIC_RELEASES

SQUID_3_0_PRE1

SQUID_3_0_PRE2

SQUID_3_0_PRE3

SQUID_3_0_PRE4

SQUID_3_0_PRE5

SQUID_3_0_PRE6

SQUID_3_0_PRE7

SQUID_3_0_RC1

SQUID_3_5_0_1

SQUID_3_5_0_2

SQUID_3_5_0_3

SQUID_3_5_0_4

SQUID_3_5_1

SQUID_3_5_10

SQUID_3_5_11

SQUID_3_5_12

SQUID_3_5_13

SQUID_3_5_14

SQUID_3_5_15

SQUID_3_5_16

SQUID_3_5_17

SQUID_3_5_18

SQUID_3_5_19

SQUID_3_5_2

SQUID_3_5_20

SQUID_3_5_21

SQUID_3_5_22

SQUID_3_5_23

SQUID_3_5_24

SQUID_3_5_25

SQUID_3_5_26

SQUID_3_5_28

SQUID_3_5_3

SQUID_3_5_4

SQUID_3_5_5

SQUID_3_5_6

SQUID_3_5_7

SQUID_3_5_8

SQUID_3_5_9

SQUID_4_0_1

SQUID_4_0_10

SQUID_4_0_11

SQUID_4_0_12

SQUID_4_0_13

SQUID_4_0_14

SQUID_4_0_15

SQUID_4_0_16

SQUID_4_0_17

SQUID_4_0_18

SQUID_4_0_19

SQUID_4_0_2

SQUID_4_0_20

SQUID_4_0_21

SQUID_4_0_22

SQUID_4_0_23

SQUID_4_0_24

SQUID_4_0_25

SQUID_4_0_3

SQUID_4_0_4

SQUID_4_0_5

SQUID_4_0_6

SQUID_4_0_7

SQUID_4_0_8

SQUID_4_0_9

SQUID_4_1

SQUID_4_2

SQUID_4_3

SQUID_4_4

SQUID_4_5

SQUID_4_6

SQUID_4_7

take00

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "29"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "19.04"
            }
        ]
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-12525.json"