CVE-2019-12519

An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow.

References

Affected packages

Git / github.com/squid-cache/squid

Affected ranges

Type

GIT

Repo

https://github.com/squid-cache/squid

Events

Introduced

Last affected

2e17b02616d37206ba9cccc53c20667624fbef9f

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.7."
        }
    ]
}

Affected versions

Other

BASIC_TPROXY4

HISTORIC_RELEASES

SQUID_3_0_PRE1

SQUID_3_0_PRE2

SQUID_3_0_PRE3

SQUID_3_0_PRE4

SQUID_3_0_PRE5

SQUID_3_0_PRE6

SQUID_3_0_PRE7

SQUID_3_0_RC1

SQUID_4_0_1

SQUID_4_0_10

SQUID_4_0_11

SQUID_4_0_12

SQUID_4_0_13

SQUID_4_0_14

SQUID_4_0_15

SQUID_4_0_16

SQUID_4_0_17

SQUID_4_0_18

SQUID_4_0_19

SQUID_4_0_2

SQUID_4_0_20

SQUID_4_0_21

SQUID_4_0_22

SQUID_4_0_23

SQUID_4_0_24

SQUID_4_0_25

SQUID_4_0_3

SQUID_4_0_4

SQUID_4_0_5

SQUID_4_0_6

SQUID_4_0_7

SQUID_4_0_8

SQUID_4_0_9

SQUID_4_1

SQUID_4_2

SQUID_4_3

SQUID_4_4

SQUID_4_5

SQUID_4_6

SQUID_4_7

for-libecap-v0p1

merge-candidate-3-v1

merge-candidate-3-v2

sourceformat-review-1

take00

take01

take02

take03

take04

take06

take07

take08

take09

take1

take2

BumpSslServerFirst.*

BumpSslServerFirst.take01

BumpSslServerFirst.take02

BumpSslServerFirst.take03

BumpSslServerFirst.take04

BumpSslServerFirst.take05

BumpSslServerFirst.take06

BumpSslServerFirst.take07

BumpSslServerFirst.take08

BumpSslServerFirst.take09

BumpSslServerFirst.take10

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12519.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "3.0"
            },
            {
                "last_affected": "3.5.28"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "4.0"
            },
            {
                "last_affected": "4.10"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.0"
            },
            {
                "last_affected": "5.0.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "19.10"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "20.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.1"
            }
        ]
    }
]