ELSA-2020-2040

ELSA-2020-2040 - squid security update

Type:	SECURITY
Severity:	IMPORTANT
Release Date:	2020-05-07

Description

[7:3.5.20-15.1]
- Resolves: #1828359 - CVE-2020-11945 squid: improper access restriction upon
Digest Authentication nonce replay could lead to remote code execution
- Resolves: #1828360 - CVE-2019-12519 squid: improper check for new member in
ESIExpression::Evaluate allows for stack buffer overflow
- Resolves: #1829772 - CVE-2019-12525 squid: parsing of header
Proxy-Authentication leads to memory corruption

Related CVEs

CVE-2019-12519

CVE-2019-12525

CVE-2020-11945

Updated Packages

Release/Architecture	Filename	MD5sum	Superseded By Advisory
Oracle Linux 7 (aarch64)	squid-3.5.20-15.el7_8.1.src.rpm	4743ea672e275b9f9379659312158690	ELSA-2021-1135
	squid-3.5.20-15.el7_8.1.aarch64.rpm	9a9888771147f83642dcbb3c56546051	ELSA-2021-1135
	squid-migration-script-3.5.20-15.el7_8.1.aarch64.rpm	4ab833e9b5f855ec8bdb5efafb61021d	ELSA-2021-1135
	squid-sysvinit-3.5.20-15.el7_8.1.aarch64.rpm	f3e46fccfcfead40ea780565b9543347	ELSA-2021-1135
Oracle Linux 7 (x86_64)	squid-3.5.20-15.el7_8.1.src.rpm	4743ea672e275b9f9379659312158690	ELSA-2021-1135
	squid-3.5.20-15.el7_8.1.x86_64.rpm	c28fc7796b3a52d23a3b47d57680d774	ELSA-2021-1135
	squid-migration-script-3.5.20-15.el7_8.1.x86_64.rpm	320697ade8b30d8083d6c971fc8806b3	ELSA-2021-1135
	squid-sysvinit-3.5.20-15.el7_8.1.x86_64.rpm	1c79f04cb04d43f241d3c04c94e62a01	ELSA-2021-1135

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team