[ubuntu/eoan-updates] squid 4.8-1ubuntu2.1 (Accepted)
Ubuntu Archive Robot
cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk
Wed Dec 4 16:58:19 UTC 2019
squid (4.8-1ubuntu2.1) eoan-security; urgency=medium
* SECURITY UPDATE: Multiple issues in URI processing
- debian/patches/CVE-2019-12523.patch: Update URI parser to use SBuf
parsing APIs in src/Downloader.cc, src/HttpRequest.cc,
src/HttpRequest.h, src/Makefile.am, src/acl/Asn.cc,
src/adaptation/ecap/MessageRep.cc, src/anyp/ProtocolType.h,
src/anyp/Uri.cc, src/anyp/Uri.h, src/anyp/UriScheme.cc,
src/anyp/UriScheme.h, src/client_side_request.cc, src/htcp.cc,
src/icmp/net_db.cc, src/icp_v2.cc, src/mgr/Inquirer.cc,
src/mime.cc, src/neighbors.cc, src/peer_digest.cc,
src/servers/FtpServer.cc, src/servers/Http1Server.cc,
src/store_digest.cc, src/tests/stub_HttpRequest.cc,
src/tests/stub_libanyp.cc, src/tests/testHttpRequest.cc,
src/urn.cc.
- CVE-2019-12523
- CVE-2019-18676
* SECURITY UPDATE: Heap Overflow issue in URN processing
- debian/patches/CVE-2019-12526.patch: fix URN response handling in
src/urn.cc.
- CVE-2019-12526
* SECURITY UPDATE: CSRF issue in HTTP Request processing
- debian/patches/CVE-2019-18677.patch: prevent truncation for large
origin-relative domains in src/anyp/Uri.cc, src/anyp/Uri.h,
src/internal.cc.
- CVE-2019-18677
* SECURITY UPDATE: HTTP Request Splitting in HTTP message processing
- debian/patches/CVE-2019-18678.patch: server MUST reject messages with
BWS after field-name in src/HttpHeader.cc, src/HttpHeader.h.
- CVE-2019-18678
- CVE-2019-18679
Date: 2019-11-19 19:37:14.392714+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk>
https://launchpad.net/ubuntu/+source/squid/4.8-1ubuntu2.1
-------------- next part --------------
Sorry, changesfile not available.
More information about the Eoan-changes
mailing list