Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "squid", "binary_version": "3.3.8-1ubuntu6.9" }, { "binary_name": "squid-cgi", "binary_version": "3.3.8-1ubuntu6.9" }, { "binary_name": "squid-cgi-dbgsym", "binary_version": "3.3.8-1ubuntu6.9" }, { "binary_name": "squid-dbgsym", "binary_version": "3.3.8-1ubuntu6.9" }, { "binary_name": "squid-purge", "binary_version": "3.3.8-1ubuntu6.9" }, { "binary_name": "squid-purge-dbgsym", "binary_version": "3.3.8-1ubuntu6.9" }, { "binary_name": "squid3", "binary_version": "3.3.8-1ubuntu6.9" }, { "binary_name": "squid3-common", "binary_version": "3.3.8-1ubuntu6.9" }, { "binary_name": "squid3-dbg", "binary_version": "3.3.8-1ubuntu6.9" }, { "binary_name": "squid3-dbgsym", "binary_version": "3.3.8-1ubuntu6.9" }, { "binary_name": "squidclient", "binary_version": "3.3.8-1ubuntu6.9" }, { "binary_name": "squidclient-dbgsym", "binary_version": "3.3.8-1ubuntu6.9" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "squid", "binary_version": "3.5.12-1ubuntu7.3" }, { "binary_name": "squid-cgi", "binary_version": "3.5.12-1ubuntu7.3" }, { "binary_name": "squid-cgi-dbgsym", "binary_version": "3.5.12-1ubuntu7.3" }, { "binary_name": "squid-common", "binary_version": "3.5.12-1ubuntu7.3" }, { "binary_name": "squid-dbg", "binary_version": "3.5.12-1ubuntu7.3" }, { "binary_name": "squid-dbgsym", "binary_version": "3.5.12-1ubuntu7.3" }, { "binary_name": "squid-purge", "binary_version": "3.5.12-1ubuntu7.3" }, { "binary_name": "squid-purge-dbgsym", "binary_version": "3.5.12-1ubuntu7.3" }, { "binary_name": "squid3", "binary_version": "3.5.12-1ubuntu7.3" }, { "binary_name": "squidclient", "binary_version": "3.5.12-1ubuntu7.3" }, { "binary_name": "squidclient-dbgsym", "binary_version": "3.5.12-1ubuntu7.3" } ] }