Faʻasaʻolotoina o le Squid 4.8 sui sui faʻatasi ma le faʻaumatiaina o se faʻafitauli matuia

lomia faasalalau faasa'oga sui sui Squid 4.8, lea na fa'amauina ai le 5 fa'aletonu. Tasi le fa'aletonu (CVE-2019-12527) e mafai ai e mafai ona fa'atulagaina le fa'atinoina o tulafono fa'atasi ma aia tatau o le fa'agaioiga o le server.

O le faʻafitauli e mafua mai i se pusa i le HTTP Basic authentication handler ma faʻatagaina se paʻu faʻafefe e faʻaosoina pe a pasi faʻailoga faʻapitoa faʻamaonia pe a maua le Squid Cache
Pule po'o le faitotoa FTP ua fausia. Ole fa'aletonu e aliali mai e amata ile fa'asa'olotoina ole Squid 4.0.23. I le avea ai o se fofo mo le polokaina o le vaivai, e mafai ona e toe fausia squid i le "--disable-auth-basic" filifiliga poʻo le faʻagata le avanoa i auaunaga e faʻaogaina ai le faʻamaoniga HTTP i le faʻatulagaga:

acl FTP proto FTP
http_access tete'e FTP
http_access teena le pule

O isi fa'aletonu e tolu e mafai ona o'o atu ai i le fa'afitia o le tautua pe a fa'aogaina le cachemgr.cgi, HTTP Digest po'o le HTTP Basic authentication. O le fa'aletonu o lo'o totoe e mafai ai ona fa'aoga tusitusiga i luga ole laiga e ala ile cachemgr.cgi.

puna: opennet.ru