Release of proxy server Squid 4.8 with critical vulnerability fix

Published corrective release of the proxy server Squid 4.8, which addresses 5 vulnerabilities. One vulnerability (CVE-2019-12527) , rather than taking focus. could potentially allow code execution with server process privileges.

This issue is caused by a bug in the HTTP Basic authentication handler, which can trigger a buffer overflow when specially crafted credentials are sent to Squid Cache
Manager or the built-in FTP gateway. The vulnerability has been present since release Squid 4.0.23. As a workaround to block the vulnerability, you can rebuild squid with the option "--disable-auth-basic" or prohibit in the configuration access to services that use HTTP authentication:

acl FTP proto FTP
http_access deny FTP
http_access deny manager

The other three vulnerabilities can lead to a denial of service when manipulating with cachemgr.cgi, HTTP Digest authentication, or HTTP Basic. The remaining vulnerability allows cross-site scripting through cachemgr.cgi.

Source: opennet.ru