corrective release of the proxy server , which eliminates 5 vulnerabilities. One vulnerability (CVE-2019-12527) potentially allows code execution with server process permissions.
The issue is caused by an error in the HTTP Basic authentication handler, which can initiate a buffer overflow when specially crafted credentials are passed to Squid Cache
Manager or the built-in FTP gateway. The vulnerability appears starting from Squid release 4.0.23. As a workaround to mitigate the vulnerability, you can rebuild squid with the option ‘—disable-auth-basic’ or prohibit access in the configuration to services using HTTP authentication:
acl FTP proto FTP
http_access deny FTP
http_access deny manager
The other three vulnerabilities can lead to denial of service during interactions with cachemgr.cgi, HTTP Digest or HTTP Basic authentication. The remaining vulnerability allows cross-site scripting through cachemgr.cgi.
Forrás: opennet.ru
