This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-25097 →

DEBIAN-CVE-2020-25097

An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Requ...

Original description

The description as published by the source.

An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 squid

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13-8"}]}]

Debian:13 squid

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13-8"}]}]

Debian:14 squid

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13-8"}]}]

References

advisory security-tracker.debian.org