QwikSec

Security Database

CVE

CWE

Training

CVE-2020-25097

Published: Mar 19, 2021

Modified: Aug 4, 2024

PUBLISHED

Description

An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/squid-cache/squid/security/advisories/GHSA-jvf6-h9gj-pmj6

x_refsource_MISC

http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_11.patch

x_refsource_MISC

http://www.squid-cache.org/Versions/v5/changesets/SQUID-2020_11.patch

x_refsource_MISC

vendor-advisory

x_refsource_DEBIAN

FEDORA-2021-ecb24e0b9d

vendor-advisory

x_refsource_FEDORA

FEDORA-2021-7d86bec29e

vendor-advisory

x_refsource_FEDORA

FEDORA-2021-76f09062a7

vendor-advisory

x_refsource_FEDORA

vendor-advisory

x_refsource_GENTOO

https://security.netapp.com/advisory/ntap-20210727-0010/

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.