Critical severity9.8NVD Advisory· Published Jul 11, 2019· Updated Jun 17, 2026
CVE-2019-12525
CVE-2019-12525
Description
An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote (which would satisfy its requirements), leading to a memcpy of its length minus 1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
36- osv-coords23 versionspkg:rpm/opensuse/squid&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/libecappkg:rpm/suse/squid&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/squid&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/squid&distro=SUSE%20Enterprise%20Storage%204pkg:rpm/suse/squid&distro=SUSE%20Enterprise%20Storage%205pkg:rpm/suse/squid&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/squid&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP1pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/squid3&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3pkg:rpm/suse/squid3&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/opensuse/squid&distro=openSUSE%20Leap%2015.0pkg:rpm/opensuse/squid&distro=openSUSE%20Leap%2015.1pkg:rpm/almalinux/libecap-devel
< 4.16-1.5+ 22 more
- (no CPE)range: < 4.16-1.5
- (no CPE)range: < 1.0.1-2.module_el8.6.0+2741+01592ae8
- (no CPE)range: < 3.5.21-26.17.1
- (no CPE)range: < 3.5.21-26.17.1
- (no CPE)range: < 3.5.21-26.17.1
- (no CPE)range: < 3.5.21-26.17.1
- (no CPE)range: < 3.5.21-26.17.1
- (no CPE)range: < 3.5.21-26.17.1
- (no CPE)range: < 3.5.21-26.17.1
- (no CPE)range: < 3.5.21-26.17.1
- (no CPE)range: < 3.5.21-26.17.1
- (no CPE)range: < 3.5.21-26.17.1
- (no CPE)range: < 3.5.21-26.17.1
- (no CPE)range: < 3.5.21-26.17.1
- (no CPE)range: < 3.5.21-26.17.1
- (no CPE)range: < 4.9-5.11.1
- (no CPE)range: < 4.9-5.11.1
- (no CPE)range: < 3.5.21-26.17.1
- (no CPE)range: < 3.1.23-8.16.37.12.1
- (no CPE)range: < 3.1.23-8.16.37.12.1
- (no CPE)range: < 4.9-lp150.13.1
- (no CPE)range: < 4.9-lp151.2.7.1
- (no CPE)range: < 1.0.1-2.module_el8.6.0+2741+01592ae8
- Squid/Squiddescription
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
12- www.squid-cache.org/Versions/v4/changesets/squid-4-7f73e9c5d17664b882ed32590e6af310c247f320.patchnvdPatchVendor Advisory
- github.com/squid-cache/squid/commits/v4nvdPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.htmlnvdMailing ListThird Party Advisory
- www.squid-cache.org/Versions/v4/changesets/nvdVendor Advisory
- lists.debian.org/debian-lts-announce/2019/07/msg00018.htmlnvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/07/msg00009.htmlnvdMailing ListThird Party Advisory
- seclists.org/bugtraq/2019/Aug/42nvdMailing ListThird Party Advisory
- usn.ubuntu.com/4065-1/nvdThird Party Advisory
- usn.ubuntu.com/4065-2/nvdThird Party Advisory
- www.debian.org/security/2019/dsa-4507nvdThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPXN2CLAGN5QSQBTOV5IGVLDOQSRFNTZ/nvd
News mentions
0No linked articles in our index yet.