SUSE-SU-2022:14908-1

Details

Description of the patch:

This update for squid fixes the following issues:

CVE-2020-15810: Fixed a HTTP Request Smuggling that could have resulted in cache poisoning (bsc#1175664).
CVE-2019-12523: Disabled urn parsing and parsing of unknown schemes (bsc#1156329).
CVE-2019-18676: Disabled urn parsing and parsing of unknown schemes (bsc#1156329).

Affected Packages

squid

SUSE Linux Enterprise High Performance Computing 11 SP4SUSE Linux Enterprise Point of Sale 11 SP3SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server 11 SP4-LTSSSUSE Linux Enterprise Server for SAP Applications 11 SP4

Fixed in:

0:2.7.STABLE5-2.12.30.6.1

References

ADVISORY

https://bugzilla.suse.com/1156329

ADVISORY

https://bugzilla.suse.com/1175664

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2022-March/010430.html

ADVISORY

https://www.suse.com/security/cve/CVE-2019-12523/

ADVISORY

https://www.suse.com/security/cve/CVE-2019-18676/

ADVISORY

https://www.suse.com/security/cve/CVE-2020-15810/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2022/suse-su-202214908-1/