squid: HTTP Request Smuggling (CVE-2020-25097)

An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.

Fixed In Version:

squid 4.14 and 5.0.5.

References:

• https://github.com/squid-cache/squid/security/advisories/GHSA-jvf6-h9gj-pmj6
• https://nvd.nist.gov/vuln/detail/CVE-2020-25097

Patch:

Squid 4: http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_11.patch

Affected branches:

• master (6d446c6e)
• 3.13-stable
• 3.12-stable
• 3.11-stable
• 3.10-stable