Detections
Analytics
CVE-2019-12527
high
Description
An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.
References
https://www.debian.org/security/2019/dsa-4507
https://usn.ubuntu.com/4065-1/
https://seclists.org/bugtraq/2019/Aug/42
https://github.com/squid-cache/squid/commits/v4