SUSE-SU-2021:1838-1

Import Source

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2021:1838-1

Related

Published

2021-06-02T14:28:33Z

Modified

2021-06-02T14:28:33Z

Summary

Security update for squid

Details

This update for squid fixes the following issues:

update to 4.15:
CVE-2021-28652: Broken cache manager URL parsing (bsc#1185918)
CVE-2021-28651: Memory leak in RFC 2169 response parsing (bsc#1185921)
CVE-2021-28662: Limit HeaderLookupTable_t::lookup() to BadHdr and specific IDs (bsc#1185919)
CVE-2021-31806: Handle more Range requests (bsc#1185916)
CVE-2020-25097: HTTP Request Smuggling vulnerability (bsc#1183436)
Handle more partial responses (bsc#1185923)
fix previous change to reinstante permissions macros, because the wrong path has been used (bsc#1171569).
use libexecdir instead of libdir to conform to recent changes in Factory (bsc#1171164).
Reinstate permissions macros for pinger binary, because the permissions package is also responsible for setting up the capnetraw capability, currently a fresh squid install doesn't get a capability bit at all (bsc#1171569).
Change pinger and basicpamauth helper to use standard permissions. pinger uses capnetraw=ep instead (bsc#1171569)

References

Affected packages

Name: squid
Purl: purl:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.15-4.18.1

{
    "binaries": [
        {
            "squid": "4.15-4.18.1"
        }
    ]
}

Name: squid
Purl: purl:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.15-4.18.1

{
    "binaries": [
        {
            "squid": "4.15-4.18.1"
        }
    ]
}