openSUSE-SU-2021:0879-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2021:0879-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/openSUSE-SU-2021:0879-1
Related
Published
2021-06-16T13:54:15Z
Modified
2021-06-16T13:54:15Z
Summary
Security update for squid
Details

This update for squid fixes the following issues:

  • update to 4.15:
  • CVE-2021-28652: Broken cache manager URL parsing (bsc#1185918)
  • CVE-2021-28651: Memory leak in RFC 2169 response parsing (bsc#1185921)
  • CVE-2021-28662: Limit HeaderLookupTable_t::lookup() to BadHdr and specific IDs (bsc#1185919)
  • CVE-2021-31806: Handle more Range requests (bsc#1185916)
  • CVE-2020-25097: HTTP Request Smuggling vulnerability (bsc#1183436)
  • Handle more partial responses (bsc#1185923)
  • fix previous change to reinstante permissions macros, because the wrong path has been used (bsc#1171569).
  • use libexecdir instead of libdir to conform to recent changes in Factory (bsc#1171164).
  • Reinstate permissions macros for pinger binary, because the permissions package is also responsible for setting up the capnetraw capability, currently a fresh squid install doesn't get a capability bit at all (bsc#1171569).
  • Change pinger and basicpamauth helper to use standard permissions. pinger uses capnetraw=ep instead (bsc#1171569)

This update was imported from the SUSE:SLE-15:Update update project.

References

Affected packages

openSUSE:Leap 15.2 / squid

Package

Name
squid
Purl
pkg:rpm/opensuse/squid&distro=openSUSE%20Leap%2015.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.15-lp152.2.9.1

Ecosystem specific

{
    "binaries": [
        {
            "squid": "4.15-lp152.2.9.1"
        }
    ]
}