漏洞标题
N/A
漏洞描述信息
在Squid 4.13之前以及5.x版本在5.0.4之前，发现了一个问题。由于不正确的数据验证，HTTP请求分割攻击可能会成功对HTTP和HTTPS流量进行攻击。这导致缓存污染。这允许任何客户端，包括浏览器脚本，绕过本地安全，污染浏览器缓存和任何下游缓存，并从任意来源获取内容。Squid 使用字符串搜索而不是解析传输编码头来查找分片编码。这允许攻击者将第二个请求隐藏在传输编码中：它被Squid解释为分片，并分裂成 upstream 发送的第二个请求。然后，Squid将向客户端发送两个不同的响应，损坏任何下游缓存。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Squid 环境问题漏洞
漏洞描述信息
Squid是一套代理服务器和Web缓存服务器软件。该软件提供缓存万维网、过滤流量、代理上网等功能。 Squid 4.13 和 5.x 到 5.0.4的版本中存在安全漏洞，攻击者可以通过该漏洞获取敏感信息。
CVSS信息
N/A
漏洞类别
环境问题