The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0262 advisory.

    This advisory aggregates security fixes for the squid SRPM in CIQ LTS 8.6. It addresses 50 CVEs:
    CVE-2019-12520, CVE-2019-12524, CVE-2013-1839, CVE-2021-28116, CVE-2019-12529, and 45 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the squid package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Squid through 4.7. When     handling the tag esi:when when ESI is enabled, Squid     calls ESIExpression::Evaluate. This function uses a     fixed stack buffer to hold the expression while it's     being evaluated. When processing the expression, it     could either evaluate the top of the stack, or add a     new member to the stack. When adding a new member,     there is no check to ensure that the stack won't     overflow.(CVE-2019-12519)

  - An issue was discovered in Squid before 5.0.2. A remote     attacker can replay a sniffed Digest Authentication     nonce to gain access to resources that are otherwise     forbidden. This occurs because the attacker can     overflow the nonce reference counter (a short integer).
    Remote code execution may occur if the pooled token     credentials are freed (instead of replayed as valid     credentials).(CVE-2020-11945)

  - An issue was discovered in Squid through 4.7. When     Squid is parsing ESI, it keeps the ESI elements in     ESIContext. ESIContext contains a buffer for holding a     stack of ESIElements. When a new ESIElement is parsed,     it is added via addStackElement. addStackElement has a     check for the number of elements in this buffer, but     it's off by 1, leading to a Heap Overflow of 1 element.
    The overflow is within the same structure so it can't     affect adjacent memory blocks, and thus just leads to a     crash while processing.(CVE-2019-12521)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2040 advisory.

  - An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid     calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's     being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a     new member to the stack. When adding a new member, there is no check to ensure that the stack won't     overflow. (CVE-2019-12519)

  - An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use     Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as     domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it     performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote     (which would satisfy its requirements), leading to a memcpy of its length minus 1. (CVE-2019-12525)

  - An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest     Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the     attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if     the pooled token credentials are freed (instead of replayed as valid credentials). (CVE-2020-11945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for squid to version 4.11 fixes the following issues :

CVE-2020-11945: Fixed a potential remote code execution vulnerability when using HTTP Digest Authentication (bsc#1170313).

CVE-2019-12519, CVE-2019-12521: Fixed incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses (bsc#1169659).

CVE-2020-8517: Fixed a possible denial of service caused by incorrect buffer management ext_lm_group_acl when processing NTLM Authentication credentials (bsc#1162691).

CVE-2019-12528: Fixed possible information disclosure when translating FTP server listings into HTTP responses (bsc#1162689).

CVE-2019-18860: Fixed handling of invalid domain names in cachemgr.cgi (bsc#1167373).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4356-1 advisory.

    Jeriko One discovered that Squid incorrectly handled certain Edge Side Includes (ESI) responses. A     malicious remote server could cause Squid to crash, possibly poison the cache, or possibly execute     arbitrary code. (CVE-2019-12519, CVE-2019-12521)

    It was discovered that Squid incorrectly handled the hostname parameter to cachemgr.cgi when certain     browsers are used. A remote attacker could possibly use this issue to inject HTML or invalid characters in     the hostname parameter. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10.
    (CVE-2019-18860)

    Clment Berthaux and Florian Guilbert discovered that Squid incorrectly handled Digest Authentication     nonce values. A remote attacker could use this issue to replay nonce values, or possibly execute arbitrary     code. (CVE-2020-11945)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2039 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow     (CVE-2019-12519)

    * squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code     execution (CVE-2020-11945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2041 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: improper check for new member in ESIExpression::Evaluate allows for stack buffer overflow     (CVE-2019-12519)

    * squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code     execution (CVE-2020-11945)

    * squid: parsing of header Proxy-Authentication leads to memory corruption (CVE-2019-12525)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-2041 advisory.

    - Resolves: #1828368 - CVE-2019-12519 squid: improper check for new member in       ESIExpression::Evaluate allows for stack buffer overflow
    - Resolves: #1828367 - CVE-2020-11945 squid: improper access restriction upon       Digest Authentication nonce replay could lead to remote code execution

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of squid installed on the remote host is prior to 3.5.20-15.39. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1386 advisory.

    An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest     Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the     attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if     the pooled token credentials are freed (instead of replayed as valid credentials). (CVE-2020-11945)

    An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid     calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's     being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a     new member to the stack. When adding a new member, there is no check to ensure that the stack won't     overflow. (CVE-2019-12519)

    An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use     Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as     domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it     performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote     (which would satisfy its requirements), leading to a memcpy of its length minus 1. (CVE-2019-12525)

    The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
    (CVE-2019-13345)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has squid packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid     calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's     being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a     new member to the stack. When adding a new member, there is no check to ensure that the stack won't     overflow. (CVE-2019-12519)

  - An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest     Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the     attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if     the pooled token credentials are freed (instead of replayed as valid credentials). (CVE-2020-11945)

  - The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a     Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service     for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP     response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed     in 4.0.23 and later. (CVE-2018-1000024)

  - The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL     Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in     Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server     responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to     have been fixed in 4.0.23 and later. (CVE-2018-1000027)

  - An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use     Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as     domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it     performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote     (which would satisfy its requirements), leading to a memcpy of its length minus 1. (CVE-2019-12525)

  - The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
    (CVE-2019-13345)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has squid packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid     calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's     being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a     new member to the stack. When adding a new member, there is no check to ensure that the stack won't     overflow. (CVE-2019-12519)

  - An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest     Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the     attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if     the pooled token credentials are freed (instead of replayed as valid credentials). (CVE-2020-11945)

  - The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a     Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service     for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP     response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed     in 4.0.23 and later. (CVE-2018-1000024)

  - The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL     Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in     Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server     responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to     have been fixed in 4.0.23 and later. (CVE-2018-1000027)

  - An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use     Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as     domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it     performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote     (which would satisfy its requirements), leading to a memcpy of its length minus 1. (CVE-2019-12525)

  - The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.
    (CVE-2019-13345)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
356925	Rocky Linux 8.6 [CIQ] Security Update: squid / squid-debuginfo / squid-debugsource Multiple Vulnerabilities (ciqsa-2026_0262)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/11/2026	critical
139158	EulerOS 2.0 SP8 : squid (EulerOS-SA-2020-1828)	Nessus	Huawei Local Security Checks	7/30/2020	2/27/2024	critical
136774	CentOS 7 : squid (RHSA-2020:2040)	Nessus	CentOS Local Security Checks	5/22/2020	10/9/2024	critical
136279	SUSE SLES15 Security Update : squid (SUSE-SU-2020:1156-1)	Nessus	SuSE Local Security Checks	5/1/2020	3/13/2024	critical
136605	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Squid vulnerabilities (USN-4356-1)	Nessus	Ubuntu Local Security Checks	5/14/2020	9/3/2025	critical
136350	RHEL 8 : squid:4 (RHSA-2020:2039)	Nessus	Red Hat Local Security Checks	5/6/2020	11/7/2024	critical
136353	RHEL 8 : squid:4 (RHSA-2020:2041)	Nessus	Red Hat Local Security Checks	5/6/2020	3/20/2025	critical
136599	Oracle Linux 8 : squid:4 (ELSA-2020-2041)	Nessus	Oracle Linux Local Security Checks	8/13/2020	10/23/2024	critical
138632	Amazon Linux AMI : squid (ALAS-2020-1386)	Nessus	Amazon Linux Local Security Checks	7/20/2020	12/11/2024	critical
143907	NewStart CGSL CORE 5.04 / MAIN 5.04 : squid Multiple Vulnerabilities (NS-SA-2020-0060)	Nessus	NewStart CGSL Local Security Checks	12/9/2020	2/5/2024	critical
143989	NewStart CGSL CORE 5.05 / MAIN 5.05 : squid Multiple Vulnerabilities (NS-SA-2020-0090)	Nessus	NewStart CGSL Local Security Checks	12/9/2020	2/5/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical