[ubuntu/xenial-security] squid3 3.5.12-1ubuntu7.15 (Accepted)

Marc Deslauriers marc.deslauriers at canonical.com
Mon Sep 28 16:36:18 UTC 2020

squid3 (3.5.12-1ubuntu7.15) xenial-security; urgency=medium

  * SECURITY UPDATE: Request Smuggling and Poisoning issue
    - debian/patches/CVE-2020-15049.patch: validate Content-Length value
      prefix in src/http/ContentLengthInterpreter.cc,
    - CVE-2020-15049
  * SECURITY UPDATE: HTTP Request Smuggling issue
    - debian/patches/CVE-2020-15810.patch: enforce token characters for
      field-name in src/HttpHeader.cc.
    - CVE-2020-15810
  * SECURITY UPDATE: HTTP Request Splitting issue
    - debian/patches/CVE-2020-15811-pre.patch: validate Content-Length
      header values in src/HttpHeader.cc, src/HttpHeaderTools.cc,
      src/HttpHeaderTools.h, src/http/ContentLengthInterpreter.cc,
      src/http/ContentLengthInterpreter.h, src/http/Makefile.am.
    - debian/patches/CVE-2020-15811.patch: Improve Transfer-Encoding
      handling in src/HttpHeader.cc, src/HttpHeader.h, src/client_side.cc,
    - CVE-2020-15811
  * SECURITY UPDATE: DoS via peer crafted Cache Digest response message
    - debian/patches/CVE-2020-24606.patch:  fix livelocking in
      peerDigestHandleReply in src/peer_digest.cc.
    - CVE-2020-24606
  * Enable the test suite
    - debian/rules: enable test suite
    - debian/patches/enable-the-test-suite.patch: fix FTBFS.
    - debian/patches/fix-stub-comm-test.patch: fix FTBFS.

squid3 (3.5.12-1ubuntu7.14) xenial; urgency=medium

  * d/squid.resolvconf: Invoke "systemctl reload --no-block" if we are
    using systemd.  This prevents squid from blocking if the reload
    action is being issued indirectly because of another
    service (e.g., because dnsmasq has been restarted), which may
    cause a deadlock and prevent the whole transaction to
    complete. (LP: #1761096)

Date: 2020-09-16 17:08:19.299343+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
-------------- next part --------------
Sorry, changesfile not available.

More information about the Xenial-changes mailing list