squid 4.8-1ubuntu2.1 source package in Ubuntu

Changelog

squid (4.8-1ubuntu2.1) eoan-security; urgency=medium

  * SECURITY UPDATE: Multiple issues in URI processing
    - debian/patches/CVE-2019-12523.patch: Update URI parser to use SBuf
      parsing APIs in src/Downloader.cc, src/HttpRequest.cc,
      src/HttpRequest.h, src/Makefile.am, src/acl/Asn.cc,
      src/adaptation/ecap/MessageRep.cc, src/anyp/ProtocolType.h,
      src/anyp/Uri.cc, src/anyp/Uri.h, src/anyp/UriScheme.cc,
      src/anyp/UriScheme.h, src/client_side_request.cc, src/htcp.cc,
      src/icmp/net_db.cc, src/icp_v2.cc, src/mgr/Inquirer.cc,
      src/mime.cc, src/neighbors.cc, src/peer_digest.cc,
      src/servers/FtpServer.cc, src/servers/Http1Server.cc,
      src/store_digest.cc, src/tests/stub_HttpRequest.cc,
      src/tests/stub_libanyp.cc, src/tests/testHttpRequest.cc,
      src/urn.cc.
    - CVE-2019-12523
    - CVE-2019-18676
  * SECURITY UPDATE: Heap Overflow issue in URN processing
    - debian/patches/CVE-2019-12526.patch: fix URN response handling in
      src/urn.cc.
    - CVE-2019-12526
  * SECURITY UPDATE: CSRF issue in HTTP Request processing
    - debian/patches/CVE-2019-18677.patch: prevent truncation for large
      origin-relative domains in src/anyp/Uri.cc, src/anyp/Uri.h,
      src/internal.cc.
    - CVE-2019-18677
  * SECURITY UPDATE: HTTP Request Splitting in HTTP message processing
    - debian/patches/CVE-2019-18678.patch: server MUST reject messages with
      BWS after field-name in src/HttpHeader.cc, src/HttpHeader.h.
    - CVE-2019-18678
    - CVE-2019-18679

 -- Marc Deslauriers <email address hidden>  Tue, 19 Nov 2019 13:18:30 -0500

Upload details

Uploaded by:
Marc Deslauriers on 2019-11-19
Uploaded to:
Eoan
Original maintainer:
Ubuntu Developers
Architectures:
any all
Section:
web
Urgency:
Medium Urgency

See full publishing history Publishing

Series Pocket Published Component Section
Eoan updates on 2019-12-04 main web
Eoan security on 2019-12-04 main web

Downloads

File Size SHA-256 Checksum
squid_4.8.orig.tar.gz 4.9 MiB f8b78efc196b84f08f1b2c21eb832dafc170e4be44d5167586a036fde5956870
squid_4.8-1ubuntu2.1.debian.tar.xz 53.0 KiB a12a56c4968825304e395fd503cd412650d29ffcad57ac070fc7596eaf7d4e12
squid_4.8-1ubuntu2.1.dsc 2.7 KiB 498d37afbdf362eb0d9ca72fcd37d467efd924407ff0390e5d8f8596531c4f89

View changes file

Binary packages built by this source

squid: Full featured Web Proxy cache (HTTP proxy)

 Squid is a high-performance proxy caching server for web clients, supporting
 FTP, gopher, ICY and HTTP data objects.

squid-cgi: Full featured Web Proxy cache (HTTP proxy) - control CGI

 Squid is a high-performance proxy caching server for web clients, supporting
 FTP, gopher, ICY and HTTP data objects.
 .
 This package contains a CGI program that can be used to query and administrate
 a `squid' proxy cache through a web browser.

squid-cgi-dbgsym: debug symbols for squid-cgi
squid-common: Full featured Web Proxy cache (HTTP proxy) - common files

 Squid is a high-performance proxy caching server for web clients, supporting
 FTP, gopher, ICY and HTTP data objects.
 .
 This package contains common files (MIB and icons)

squid-dbgsym: debug symbols for squid
squid-purge: Full featured Web Proxy cache (HTTP proxy) - cache management utility

 Squid is a high-performance proxy caching server for web clients, supporting
 FTP, gopher, ICY and HTTP data objects.
 .
 This package contains a small utility that can be used to manage the disk cache
 from the command line.

squid-purge-dbgsym: debug symbols for squid-purge
squid3: Transitional package

 Squid is a high-performance proxy caching server for web clients, supporting
 FTP, gopher, ICY and HTTP data objects.
 .
 This is a transitional package used to migrate from squid3 to squid.

squidclient: Full featured Web Proxy cache (HTTP proxy) - HTTP(S) message utility

 Squid is a high-performance proxy caching server for web clients, supporting
 FTP, gopher, ICY and HTTP data objects.
 .
 This package contains a small utility that can be used to get URLs from the
 command line.

squidclient-dbgsym: debug symbols for squidclient