An issue was discovered in Squid through 4.7. When handling...
Vulnerability Description
An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-12519
Credits & Attribution
No credits recorded in the NVD database.
References
- https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12519.txt
- http://www.openwall.com/lists/oss-security/2020/04/23/1
- https://www.debian.org/security/2020/dsa-4682
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html
- https://security.gentoo.org/glsa/202005-05
- https://usn.ubuntu.com/4356-1/
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://security.netapp.com/advisory/ntap-20210205-0006/
More from squid-cache
View All →Affected Vendor
squid-cache
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.