Register | Log in

squid

Full featured Web Proxy cache (HTTP proxy)

Choose email to subscribe with

general

source: squid (main)
version: 4.10-1
maintainer: Luigi Gangitano (DMD)
uploaders: Santiago Garcia Mantinan [DMD]
arch: all any
std-ver: 4.5.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 4.6-1+deb10u1
stable-sec: 4.6-1+deb10u1
testing: 4.10-1
unstable: 4.10-1

versioned links

4.6-1+deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.10-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

squid (17 bugs: 0, 12, 5, 0)
squid-cgi
squid-common
squid-purge
squidclient

action needed

Debci reports failed tests high

unstable: fail (log)
The tests ran in 0:03:10
Last run: 2020-01-25 05:28:48 UTC
Previous status: fail

testing: fail (log)
The tests ran in 0:03:01
Last run: 2020-02-15 13:22:15 UTC
Previous status: fail

stable: fail (log)
The tests ran in 0:07:49
Last run: 2019-08-25 20:00:19 UTC
Previous status: fail

Created: 2019-02-25 Last update: 2020-02-23 17:06

9 security issues in buster high

There are 9 open security issues in buster.

9 important issues:

CVE-2020-8450: An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy.
CVE-2020-8449: An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.
CVE-2019-12528: An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes.
CVE-2019-12523: An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost.
CVE-2019-12526: An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap.
CVE-2019-18676: An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity is high due to this vulnerability occurring before normal security checks; any remote client that can reach the proxy port can trivially perform the attack via a crafted URI scheme.
CVE-2019-18678: An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. There are no effects on Squid itself, nor on any upstream servers. The issue is related to a request header containing whitespace between a header name and a colon.
CVE-2019-18679: An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.
CVE-2019-18677: An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.

Please fix them.

Created: 2019-11-09 Last update: 2020-02-16 05:30

5 bugs tagged patch in the BTS normal

The BTS contains patches fixing 5 bugs (7 if counting merged bugs), consider including or untagging them.

Created: 2020-02-18 Last update: 2020-02-23 17:02

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 4.10-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 55ab5ff3e9b057897a9a045d95e4da385fbfbf38
Author: Amos Jeffries <amosjeffries@squid-cache.org>
Date:   Fri Feb 14 23:39:00 2020 +1300

    Remove unused scripts

Created: 2020-02-14 Last update: 2020-02-22 02:06

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2018-07-04 Last update: 2018-07-04 08:17

news

[2020-02-16] squid 4.10-1 MIGRATED to testing (Debian testing watch)
[2020-02-10] Accepted squid 4.10-1 (source) into unstable (Debian FTP Masters) (signed by: Luigi Gangitano)
[2019-11-16] squid 4.9-2 MIGRATED to testing (Debian testing watch)
[2019-11-14] Accepted squid 4.9-2 (source) into unstable (Luigi Gangitano)
[2019-11-13] squid 4.9-1 MIGRATED to testing (Debian testing watch)
[2019-11-10] Accepted squid 4.9-1 (source) into unstable (Luigi Gangitano)
[2019-08-31] squid 4.6-1+deb10u1 MIGRATED to testing (Debian testing watch)
[2019-08-25] Accepted squid 4.6-1+deb10u1 (source) into proposed-updates->stable-new, proposed-updates (Salvatore Bonaccorso)
[2019-08-24] Accepted squid 4.6-1+deb10u1 (source) into stable->embargoed, stable (Salvatore Bonaccorso)
[2019-07-18] Accepted squid 4.8-1 (source amd64 all) into unstable (Luigi Gangitano)
[2019-03-07] Accepted squid 4.6-2 (source amd64 all) into unstable (Luigi Gangitano)
[2019-03-05] squid 4.6-1 MIGRATED to testing (Debian testing watch)
[2019-02-22] Accepted squid 4.6-1 (source amd64 all) into unstable (Luigi Gangitano)
[2019-02-21] Accepted squid 4.5-2 (source amd64 all) into unstable (Luigi Gangitano)
[2018-11-02] squid 4.4-1 MIGRATED to testing (Debian testing watch)
[2018-10-30] Accepted squid 4.4-1 (source amd64 all) into unstable (Luigi Gangitano)
[2018-10-15] squid 4.3-1 MIGRATED to testing (Debian testing watch)
[2018-10-08] Accepted squid 4.3-1 (source amd64 all) into unstable (Luigi Gangitano)
[2018-09-02] squid 4.2-2 MIGRATED to testing (Debian testing watch)
[2018-08-24] Accepted squid 4.2-2 (source amd64 all) into unstable (Luigi Gangitano)
[2018-08-22] Accepted squid 4.2-1 (source amd64 all) into unstable (Luigi Gangitano)
[2018-07-03] Accepted squid 4.1-1 (source amd64 all) into unstable (Luigi Gangitano)
[2018-04-30] Accepted squid 4.0.24-1~exp16 (source amd64 all) into experimental (Luigi Gangitano)
[2018-04-29] Accepted squid 4.0.24-1~exp15 (source amd64 all) into experimental (Luigi Gangitano)
[2018-02-02] Accepted squid 2.7.STABLE9-4.1+deb7u3 (source all amd64) into oldoldstable (Roberto C. Sanchez)
[2018-01-23] Accepted squid 4.0.23-1~exp8 (source amd64 all) into experimental (Luigi Gangitano)
[2017-11-21] Accepted squid 4.0.21-1~exp5 (source amd64 all) into experimental, experimental (Santiago Garcia Mantinan)
[2016-07-25] Accepted squid 2.7.STABLE9-4.1+deb7u2 (source all amd64) into oldstable (Santiago Ruano Rincón)
[2015-05-18] Removed 2.7.STABLE9-5 from unstable
[2015-04-30] Accepted squid 2.7.STABLE9-2.1+deb6u1 (source all amd64) into squeeze-lts (Santiago Ruano Rincón)

1
2

bugs [bug history graph]

all: 31 35
RC: 1
I&N: 18 21
M&W: 12 13
F&P: 0
patch: 5 7

links

homepage
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker
screenshots
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 4.9-2ubuntu4
5 bugs

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing