crítica
CVE-2019-12524
squid: Improper access restriction in url_regex may lead to security bypass
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Amazon. Más baja según Oracle (alta), Red Hat (media), AlmaLinux (media), Rocky Linux (media), Ubuntu (media).
Descripción
An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the url_regex check, and gain access to the blocked resource.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 2 | squid, squid-debuginfo, squid-migration-script y 1 más | 7:3.5.20-17.amzn2.7.10 |
| alma 8 | squid:4::libecap, squid:4::libecap-devel | 1.0.1-2.module_el8.6.0+2741+01592ae8 |
| debian 10 | squid | 4.6-1+deb10u2 |
| debian 11 | squid | 4.8-1 |
| debian 12 | squid | 4.8-1 |
| debian 13 | squid | 4.8-1 |
| debian 14 | squid | 4.8-1 |
| debian 9 | squid3 | 3.5.23-5+deb9u2 |
| echo | squid | 4.8-1 |
| Oracle Linux 7 | squid | 7:4.11-3.0.1.el7 |
| Oracle Linux 8 | libecap, libecap-devel, squid | 1.0.1-2.module+el8.3.0+7819+eb7d4ef6 y 1 más |
| Red Hat | squid, squid-migration-script, squid-sysvinit y 1 más | sin corrección indicada |
Mostrar las 25 entradas de 15 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| amazon linux 2 | squid | 7:3.5.20-17.amzn2.7.10 |
| amazon linux 2 | squid-debuginfo | 7:3.5.20-17.amzn2.7.10 |
| amazon linux 2 | squid-migration-script | 7:3.5.20-17.amzn2.7.10 |
| amazon linux 2 | squid-sysvinit | 7:3.5.20-17.amzn2.7.10 |
| alma 8 | squid:4::libecap | 1.0.1-2.module_el8.6.0+2741+01592ae8 |
| alma 8 | squid:4::libecap-devel | 1.0.1-2.module_el8.6.0+2741+01592ae8 |
| debian 10 | squid | 4.6-1+deb10u2 |
| debian 11 | squid | 4.8-1 |
| debian 12 | squid | 4.8-1 |
| debian 13 | squid | 4.8-1 |
| debian 14 | squid | 4.8-1 |
| debian 9 | squid3 | 3.5.23-5+deb9u2 |
| echo | squid | 4.8-1 |
| Oracle Linux 7 | squid | 7:4.11-3.0.1.el7 |
| Oracle Linux 8 | libecap | 1.0.1-2.module+el8.3.0+7819+eb7d4ef6 |
| Oracle Linux 8 | libecap-devel | 1.0.1-2.module+el8.3.0+7819+eb7d4ef6 |
| Oracle Linux 8 | squid | 7:4.11-3.module+el8.3.0+7819+eb7d4ef6 |
| Red Hat | squid | sin corrección indicada |
| Red Hat | squid-migration-script | sin corrección indicada |
| Red Hat | squid-sysvinit | sin corrección indicada |
| Red Hat | squid34 | sin corrección indicada |
| rocky 8 | squid:4::libecap | 1.0.1-2.module+el8.4.0+404+316a0dc5 |
| rocky 8 | squid:4::libecap-devel | 1.0.1-2.module+el8.4.0+404+316a0dc5 |
| ubuntu 18.04 | squid3 | 3.5.27-1ubuntu1.7 |
| ubuntu 18.04-ESM | squid3 | 3.5.27-1ubuntu1.7 |
Referencias
- http://www.squid-cache.org/Advisories/SQUID-2019_4.txt
- https://access.redhat.com/security/cve/CVE-2019-12524
- https://bugzilla.redhat.com/show_bug.cgi?id=1730523
- https://bugzilla.redhat.com/show_bug.cgi?id=1730528
- https://bugzilla.redhat.com/show_bug.cgi?id=1770349
- https://bugzilla.redhat.com/show_bug.cgi?id=1770356
- https://bugzilla.redhat.com/show_bug.cgi?id=1770360
- https://bugzilla.redhat.com/show_bug.cgi?id=1770365
Las 50 referencias
- https://bugzilla.redhat.com/show_bug.cgi?id=1770371
- https://bugzilla.redhat.com/show_bug.cgi?id=1770375
- https://bugzilla.redhat.com/show_bug.cgi?id=1798534
- https://bugzilla.redhat.com/show_bug.cgi?id=1798540
- https://bugzilla.redhat.com/show_bug.cgi?id=1798552
- https://bugzilla.redhat.com/show_bug.cgi?id=1817121
- https://bugzilla.redhat.com/show_bug.cgi?id=1827558
- https://bugzilla.redhat.com/show_bug.cgi?id=1827562
- https://bugzilla.redhat.com/show_bug.cgi?id=1827570
- https://bugzilla.redhat.com/show_bug.cgi?id=1852550
- https://bugzilla.redhat.com/show_bug.cgi?id=1852554
- https://bugzilla.redhat.com/show_bug.cgi?id=1871705
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12520
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12521
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12523
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12524
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12526
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12528
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12529
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12854
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18676
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18677
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18678
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18679
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18860
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14058
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15049
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24606
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8449
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8450
- https://errata.almalinux.org/8/ALSA-2020-4743.html
- https://errata.rockylinux.org/RLSA-2020:4743
- https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12524.txt
- https://linux.oracle.com/cve/CVE-2019-12524.html
- https://linux.oracle.com/errata/ELSA-2022-22254.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-12524
- https://security.netapp.com/advisory/ntap-20210205-0006/
- https://ubuntu.com/security/notices/USN-4446-1
- https://usn.ubuntu.com/4446-1/
- https://www.cve.org/CVERecord?id=CVE-2019-12524
- https://www.debian.org/security/2020/dsa-4682