HTTP Request Splitting Vulnerability in Squid Proxy Server
CVE-2020-15811

6.5MEDIUM

Key Information:

Vendor

Squid-cache

Status
Squid
Vendor
CVE Published:
2 September 2020

What is CVE-2020-15811?

A vulnerability exists in the Squid Proxy Server that can be exploited through incorrect data validation. Specifically, it enables attackers to perform HTTP Request Splitting attacks which can affect both HTTP and HTTPS traffic. This vulnerability allows malicious clients to bypass local security measures, potentially leading to cache poisoning. By manipulating the Transfer-Encoding header, an attacker can embed a second request within a successfully parsed request, which is then misinterpreted by Squid. As a result, Squid may deliver corrupt responses to clients, compromising the integrity of any downstream caches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://github.com/squid-cache/squid/security/advisories/...
x_refsource_MISC
https://www.debian.org/security/2020/dsa-4751
vendor-advisoryx_refsource_DEBIAN
https://usn.ubuntu.com/4477-1/
vendor-advisoryx_refsource_UBUNTU

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.