critical
CVE-2019-12523
squid: Improper input validation in URI processor
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Amazon (high), Oracle (high), Red Hat (medium), AlmaLinux (medium), Rocky Linux (medium), Ubuntu (medium).
Description
An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alma 8 | squid:4::libecap, squid:4::libecap-devel | 1.0.1-2.module_el8.6.0+2741+01592ae8 |
| amazon linux 1 | squid, squid-debuginfo, squid-migration-script | 7:3.5.20-17.46.amzn1 |
| amazon linux 2 | squid, squid-debuginfo, squid-migration-script and 1 more | 7:3.5.20-17.amzn2.7.5 |
| debian 10 | squid | 4.6-1+deb10u2 |
| debian 11 | squid | 4.9-1 |
| debian 12 | squid | 4.9-1 |
| debian 13 | squid | 4.9-1 |
| debian 14 | squid | 4.9-1 |
| debian 9 | squid3 | 3.5.23-5+deb9u2 |
| echo | squid | 4.9-1 |
| Oracle Linux 7 | squid | 7:4.11-3.0.1.el7 |
| Oracle Linux 8 | libecap, libecap-devel, squid | 1.0.1-2.module+el8.3.0+7819+eb7d4ef6 and 1 more |
Show all 36 entries from 24 sources
| Source | Package | Fixed in |
|---|---|---|
| alma 8 | squid:4::libecap | 1.0.1-2.module_el8.6.0+2741+01592ae8 |
| alma 8 | squid:4::libecap-devel | 1.0.1-2.module_el8.6.0+2741+01592ae8 |
| amazon linux 1 | squid | 7:3.5.20-17.46.amzn1 |
| amazon linux 1 | squid-debuginfo | 7:3.5.20-17.46.amzn1 |
| amazon linux 1 | squid-migration-script | 7:3.5.20-17.46.amzn1 |
| amazon linux 2 | squid | 7:3.5.20-17.amzn2.7.5 |
| amazon linux 2 | squid-debuginfo | 7:3.5.20-17.amzn2.7.5 |
| amazon linux 2 | squid-migration-script | 7:3.5.20-17.amzn2.7.5 |
| amazon linux 2 | squid-sysvinit | 7:3.5.20-17.amzn2.7.5 |
| debian 10 | squid | 4.6-1+deb10u2 |
| debian 11 | squid | 4.9-1 |
| debian 12 | squid | 4.9-1 |
| debian 13 | squid | 4.9-1 |
| debian 14 | squid | 4.9-1 |
| debian 9 | squid3 | 3.5.23-5+deb9u2 |
| echo | squid | 4.9-1 |
| Oracle Linux 7 | squid | 7:4.11-3.0.1.el7 |
| Oracle Linux 8 | libecap | 1.0.1-2.module+el8.3.0+7819+eb7d4ef6 |
| Oracle Linux 8 | libecap-devel | 1.0.1-2.module+el8.3.0+7819+eb7d4ef6 |
| Oracle Linux 8 | squid | 7:4.11-3.module+el8.3.0+7819+eb7d4ef6 |
| Red Hat | squid | no fix listed |
| Red Hat | squid-migration-script | no fix listed |
| Red Hat | squid-sysvinit | no fix listed |
| Red Hat | squid34 | no fix listed |
| rocky 8 | squid:4::libecap | 1.0.1-2.module+el8.4.0+404+316a0dc5 |
| rocky 8 | squid:4::libecap-devel | 1.0.1-2.module+el8.4.0+404+316a0dc5 |
| ubuntu 16.04 | squid3 | 3.5.12-1ubuntu7.12 |
| ubuntu 16.04-ESM | squid3 | 3.5.12-1ubuntu7.12 |
| ubuntu 18.04 | squid3 | 3.5.27-1ubuntu1.7 |
| ubuntu 18.04-ESM | squid3 | 3.5.27-1ubuntu1.7 |
| ubuntu 19.04 | squid | 4.4-1ubuntu2.3 |
| ubuntu 19.10 | squid | 4.8-1ubuntu2.1 |
| ubuntu 20.04 | squid | 4.9-2ubuntu1 |
| ubuntu 20.04-ESM | squid | 4.9-2ubuntu1 |
| ubuntu 20.10 | squid | 4.9-2ubuntu1 |
| ubuntu 21.04 | squid | 4.9-2ubuntu1 |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html
- http://www.squid-cache.org/Advisories/SQUID-2019_8.txt
- https://access.redhat.com/security/cve/CVE-2019-12523
- https://bugzilla.redhat.com/show_bug.cgi?id=1730523
- https://bugzilla.redhat.com/show_bug.cgi?id=1730528
- https://bugzilla.redhat.com/show_bug.cgi?id=1770349
- https://bugzilla.redhat.com/show_bug.cgi?id=1770356
- https://bugzilla.redhat.com/show_bug.cgi?id=1770360
All 54 references
- https://bugzilla.redhat.com/show_bug.cgi?id=1770365
- https://bugzilla.redhat.com/show_bug.cgi?id=1770371
- https://bugzilla.redhat.com/show_bug.cgi?id=1770375
- https://bugzilla.redhat.com/show_bug.cgi?id=1798534
- https://bugzilla.redhat.com/show_bug.cgi?id=1798540
- https://bugzilla.redhat.com/show_bug.cgi?id=1798552
- https://bugzilla.redhat.com/show_bug.cgi?id=1817121
- https://bugzilla.redhat.com/show_bug.cgi?id=1827558
- https://bugzilla.redhat.com/show_bug.cgi?id=1827562
- https://bugzilla.redhat.com/show_bug.cgi?id=1827570
- https://bugzilla.redhat.com/show_bug.cgi?id=1852550
- https://bugzilla.redhat.com/show_bug.cgi?id=1852554
- https://bugzilla.redhat.com/show_bug.cgi?id=1871705
- https://bugzilla.suse.com/show_bug.cgi?id=1156329
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12520
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12521
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12523
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12524
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12526
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12528
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12529
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12854
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18676
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18677
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18678
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18679
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18860
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14058
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15049
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24606
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8449
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8450
- https://errata.almalinux.org/8/ALSA-2020-4743.html
- https://errata.rockylinux.org/RLSA-2020:4743
- https://linux.oracle.com/cve/CVE-2019-12523.html
- https://linux.oracle.com/errata/ELSA-2022-22254.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/
- https://nvd.nist.gov/vuln/detail/CVE-2019-12523
- https://ubuntu.com/security/notices/USN-4213-1
- https://ubuntu.com/security/notices/USN-4446-1
- https://usn.ubuntu.com/4213-1/
- https://usn.ubuntu.com/4446-1/
- https://www.cve.org/CVERecord?id=CVE-2019-12523
- https://www.debian.org/security/2020/dsa-4682