Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2020-15049 →
DEBIAN-CVE-2020-15049
An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can su...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
squid
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12-1"}]}]
Debian:13
squid
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12-1"}]}]
Debian:14
squid
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12-1"}]}]
Références
- advisory security-tracker.debian.org