High severity7.5NVD Advisory· Published Nov 26, 2019· Updated Jun 17, 2026
CVE-2019-18679
CVE-2019-18679
Description
An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
42- Squid/Squiddescription
- osv-coords24 versionspkg:rpm/opensuse/squid&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/libecappkg:rpm/opensuse/squid&distro=openSUSE%20Leap%2015.1pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP1pkg:rpm/opensuse/squid&distro=openSUSE%20Leap%2015.0pkg:rpm/suse/squid&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/squid&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/squid&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/squid&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/squid&distro=SUSE%20Enterprise%20Storage%205pkg:rpm/suse/squid3&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3pkg:rpm/suse/squid3&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/almalinux/libecap-devel
< 4.16-1.5+ 23 more
- (no CPE)range: < 4.16-1.5
- (no CPE)range: < 1.0.1-2.module_el8.6.0+2741+01592ae8
- (no CPE)range: < 4.9-lp151.2.7.1
- (no CPE)range: < 4.9-5.11.1
- (no CPE)range: < 4.9-4.3.2
- (no CPE)range: < 4.9-4.3.2
- (no CPE)range: < 3.5.21-26.20.1
- (no CPE)range: < 3.5.21-26.20.1
- (no CPE)range: < 3.5.21-26.20.1
- (no CPE)range: < 3.5.21-26.20.1
- (no CPE)range: < 3.5.21-26.20.1
- (no CPE)range: < 4.9-5.11.1
- (no CPE)range: < 4.9-lp150.13.1
- (no CPE)range: < 3.5.21-26.20.1
- (no CPE)range: < 3.5.21-26.20.1
- (no CPE)range: < 3.5.21-26.20.1
- (no CPE)range: < 3.5.21-26.20.1
- (no CPE)range: < 3.5.21-26.20.1
- (no CPE)range: < 3.5.21-26.20.1
- (no CPE)range: < 3.5.21-26.20.1
- (no CPE)range: < 3.5.21-26.20.1
- (no CPE)range: < 3.1.23-8.16.37.12.1
- (no CPE)range: < 3.1.23-8.16.37.12.1
- (no CPE)range: < 1.0.1-2.module_el8.6.0+2741+01592ae8
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*range: >=2.0,<=2.7
- cpe:2.3:a:squid-cache:squid:2.7:stable2:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:2.7:stable3:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:2.7:stable4:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:2.7:stable5:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:2.7:stable6:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:2.7:stable7:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:2.7:stable8:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:2.7:stable9:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
11- github.com/squid-cache/squid/pull/491nvdPatchThird Party Advisory
- www.squid-cache.org/Advisories/SQUID-2019_11.txtnvdThird Party Advisory
- bugzilla.suse.com/show_bug.cginvdIssue TrackingThird Party Advisory
- lists.debian.org/debian-lts-announce/2019/12/msg00011.htmlnvdThird Party Advisory
- usn.ubuntu.com/4213-1/nvdThird Party Advisory
- www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156dc4c717ee52ad22fba0f7443.patchnvdRelease Notes
- lists.debian.org/debian-lts-announce/2020/07/msg00009.htmlnvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/nvd
- security.gentoo.org/glsa/202003-34nvd
- www.debian.org/security/2020/dsa-4682nvd
News mentions
0No linked articles in our index yet.