[ubuntu/hirsute-security] squid 4.13-1ubuntu4.1 (Accepted)

[Marc Deslauriers]

squid (4.13-1ubuntu4.1) hirsute-security; urgency=medium

  * SECURITY UPDATE: DoS via buffer-management bug
    - debian/patches/CVE-2021-28651.patch: fix memory leak in src/urn.cc.
    - CVE-2021-28651
  * SECURITY UPDATE: DoS via incorrect parser validation
    - debian/patches/CVE-2021-28652.patch: fix cache manager URL parsing in
      src/CacheManager.h, src/cache_manager.cc, src/mgr/QueryParams.cc,
      src/mgr/QueryParams.h, src/tests/stub_libmgr.cc,
      src/tests/testCacheManager.cc, src/tests/testCacheManager.h.
    - CVE-2021-28652
  * SECURITY UPDATE: DoS via certain response header
    - debian/patches/CVE-2021-28662.patch: limit
      HeaderLookupTable_t::lookup() to BadHdr and specific IDs in
      src/http/RegisteredHeaders.cc.
    - CVE-2021-28662
  * SECURITY UPDATE: DoS via HTTP Range request
    - debian/patches/CVE-2021-3180x.patch: handle more Range requests in
      src/HttpHdrRange.cc, src/HttpHeaderRange.h, src/client_side.cc,
      src/client_side_request.cc, src/client_side_request.h,
      src/http/Stream.cc.
    - CVE-2021-31806
    - CVE-2021-31807
    - CVE-2021-31808
  * SECURITY UPDATE: DoS via HTTP response
    - debian/patches/CVE-2021-33620.patch: handle more partial responses in
      src/HttpHdrContRange.cc, src/HttpHeaderRange.h,
      src/clients/Client.cc, src/http/Stream.cc.
    - CVE-2021-33620

Date: 2021-06-02 16:00:19.068071+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/squid/4.13-1ubuntu4.1
-------------- next part --------------
Sorry, changesfile not available.