CVE-2019-12529 (retired)

Priority
Description
An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through
3.5.28, and 4.x through 4.7. When Squid is configured to use Basic
Authentication, the Proxy-Authorization header is parsed via uudecode.
uudecode determines how many bytes will be decoded by iterating over the
input and checking its table. The length is then used to start decoding the
string. There are no checks to ensure that the length it calculates isn't
greater than the input buffer. This leads to adjacent memory being decoded
as well. An attacker would not be able to retrieve the decoded data unless
the Squid maintainer had configured the display of usernames on error
pages.
Notes
 mdeslaur> as of 2019-07-12, no equivalent fix in 3.5.x tree
Assigned-to
mdeslaur
Package
Source: squid (LP Ubuntu Debian)
Upstream:released (4.8)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 18.04 LTS (Bionic Beaver):DNE
Ubuntu 19.04 (Disco Dingo):released (4.4-1ubuntu2.2)
Ubuntu 19.10 (Eoan):released (4.6-2ubuntu4)
Patches:
Upstream:https://github.com/squid-cache/squid/commit/dd46b5417809647f561d8a5e0e74c3aacd235258 (v4)
Package
Upstream:needed
Ubuntu 12.04 ESM (Precise Pangolin):released (3.1.19-1ubuntu3.12.04.10)
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):released (3.5.12-1ubuntu7.8)
Ubuntu 18.04 LTS (Bionic Beaver):released (3.5.27-1ubuntu1.3)
Ubuntu 19.04 (Disco Dingo):DNE
Ubuntu 19.10 (Eoan):DNE
More Information

Updated: 2019-07-24 13:15:55 UTC (commit a287546e8136670c5866b28fff2bebda1d92a7e1)