RHBA-2012:1290 - Bug Fix Advisory

Topic

Updated squid packages that fix several bugs are now available for Red Hat
Enterprise Linux 6.

[Updated 20th September 2012]
This advisory has been updated with an accurate description of the "http10"
option for BZ#852863. This update does not change the packages in any way.

Description

Squid is a high-performance proxy caching server for web clients that supports
FTP, Gopher, and HTTP data objects.

This update fixes the following bugs:

• Due to a bug in the ConnStateData::noteMoreBodySpaceAvailable() function,

child processes of squid aborted upon encountering a failed assertion. An
upstream patch has been provided to address this issue and squid child processes
no longer abort in the described scenario. (BZ#853053)

• Due to an upstream patch, which renamed the HTTP header controlling persistent

connections from "Proxy-Connection" to "Connection", the NTLM pass-through
authentication does not work, thus preventing login. This update introduces the
new "http10" option to the squid.conf file, which can be used to enable the
change in the patch. This option is set to "off" by default. When set to "on",
the NTLM pass-through authentication works properly, thus allowing login
attempts to succeed. (BZ#852863)

• When the IPv6 protocol was disabled and squid tried to handle an HTTP GET

request containing an IPv6 address, the squid child process terminated due to
signal 6. This bug has been fixed and such requests are now handled as expected.
(BZ#852861)

• The old "stale if hit" logic did not account for cases where the stored stale

response became fresh due to a successful re-validation with the origin server.
Consequently, incorrect warning messages were returned. With this update, squid
no longer marks elements as stale in the described scenario, thus fixing this
bug. (BZ#855330)

All users of squid are advised to upgrade to these updated packages, which fix
these bugs.

Solution

Before applying this update, make sure all previously-released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.3 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.3 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.3 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.3 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.3 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 852861 - Squid exits due to signal 6 when IPv6 is disabled and HTTP GET request contains IPv6 address
• BZ - 852863 - The NTLM pass-through authentication doesn't work via squid-3.1.10
• BZ - 855330 - squid incorrectly marks elements as stale when the client uses If-Modified-Since and If-None-Match headers

CVEs

(none)

References

(none)