CVE-2020-15810

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-15810
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15810.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-15810
Downstream
Related
Published
2020-09-02T17:15:11.627Z
Modified
2026-03-15T22:34:23.002640Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.

References

Affected packages

Git / github.com/squid-cache/squid

Affected ranges

Type
GIT
Repo
https://github.com/squid-cache/squid
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3f5d044d9a4873b3c769d13c43d5d3f9bfe258a3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a3f681bfbc39768cecd7d12271e99f32fe4425e3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0f67e2aac4a27d0c5ffbfa1dcd89d8abbc7175a7
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.13"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "32"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "33"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15810.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "5.0"
            },
            {
                "fixed": "5.0.4"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "20.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "31"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.2"
            }
        ]
    }
]