Issued:
2019-09-02
Updated:
2019-09-02

RHSA-2019:2593 - Security Advisory

Synopsis

Important: squid:4 security update

Type/Severity

Security Advisory: Important

Topic

An update for the squid:4 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es):

  • squid: heap-based buffer overflow in HttpHeader::getAuth (CVE-2019-12527)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the squid service will be restarted automatically.

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 1730533 - CVE-2019-12527 squid: heap-based buffer overflow in HttpHeader::getAuth

CVEs

References

Red Hat Enterprise Linux for x86_64 8

SRPM
libecap-1.0.1-2.module+el8.0.0+4045+70edde92.src.rpm SHA-256: 4c7a3e66334fa0e3781d1d9925fac22ece7577b17a5eb77331fc580cbd13612c
squid-4.4-5.module+el8.0.0+4045+70edde92.src.rpm SHA-256: 59786225933fa0eccb0198020f2cae96712e0360dc4504a8a554f7bcc8213974
x86_64
libecap-1.0.1-2.module+el8.0.0+4045+70edde92.x86_64.rpm SHA-256: 09e944bcb7f6dc03ebca5f337453519e72f0085ee2570326b17b6fea12a36731
libecap-debuginfo-1.0.1-2.module+el8.0.0+4045+70edde92.x86_64.rpm SHA-256: 987b17882a3906ca6060cb7a6f508373816136ebfe4ddfdc6efc807cec352ca7
libecap-debugsource-1.0.1-2.module+el8.0.0+4045+70edde92.x86_64.rpm SHA-256: 5ced2cbff33574dc5a727b7aa5b605bac525c971f6987bb4fe3feaab2853f5e6
libecap-devel-1.0.1-2.module+el8.0.0+4045+70edde92.x86_64.rpm SHA-256: 9f394c371b149664e55fe8c62e5e673f1005f845c5aaae21bbd348cdae150555
squid-4.4-5.module+el8.0.0+4045+70edde92.x86_64.rpm SHA-256: 589a9ee512e66fe8aa64f9da85b3a13e7df25db45263f3a4dbab4fbcecebf264
squid-debuginfo-4.4-5.module+el8.0.0+4045+70edde92.x86_64.rpm SHA-256: caef1a83ff091699fc84cd76b3bf08f70f1f97478840f43aeda52d586008a71d
squid-debugsource-4.4-5.module+el8.0.0+4045+70edde92.x86_64.rpm SHA-256: 262c05aaa91cc0444a2a83e84f4ab74a9c68c027e58dcfec324064628243412d

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
libecap-1.0.1-2.module+el8.0.0+4045+70edde92.src.rpm SHA-256: 4c7a3e66334fa0e3781d1d9925fac22ece7577b17a5eb77331fc580cbd13612c
squid-4.4-5.module+el8.0.0+4045+70edde92.src.rpm SHA-256: 59786225933fa0eccb0198020f2cae96712e0360dc4504a8a554f7bcc8213974
s390x
libecap-1.0.1-2.module+el8.0.0+4045+70edde92.s390x.rpm SHA-256: f870c90389590e767c0d953e5dfec356e6fdd1067f8a566efdd04f9f7fcb61fe
libecap-debuginfo-1.0.1-2.module+el8.0.0+4045+70edde92.s390x.rpm SHA-256: 25470fce11a05265b990aae0f8af293d11bd2b1accde212cfea62e33ef31e5b2
libecap-debugsource-1.0.1-2.module+el8.0.0+4045+70edde92.s390x.rpm SHA-256: 71fa83cf601ef9982aa610a9ca40e27d02dce8ec16f88df5ed9d19e50a09cbcd
libecap-devel-1.0.1-2.module+el8.0.0+4045+70edde92.s390x.rpm SHA-256: 50ac5a9ef53d5c1d88310677b22a7bca79a082aad3728fc9b13e9ecd7bb07f70
squid-4.4-5.module+el8.0.0+4045+70edde92.s390x.rpm SHA-256: 8bc4c599641f575d7b99be69936ddb7ab58b10257bc70c6790258ff17a82f606
squid-debuginfo-4.4-5.module+el8.0.0+4045+70edde92.s390x.rpm SHA-256: cb54f3a2ae61bfdf2ad1e0763e08e7ef1e19bab7a6f3d83f0cd74258b1bca6c2
squid-debugsource-4.4-5.module+el8.0.0+4045+70edde92.s390x.rpm SHA-256: 2241063bf05f391fb64c6f8b197c27fe686990f4ddcae48ccb4fa26b2cdd1617

Red Hat Enterprise Linux for Power, little endian 8

SRPM
libecap-1.0.1-2.module+el8.0.0+4045+70edde92.src.rpm SHA-256: 4c7a3e66334fa0e3781d1d9925fac22ece7577b17a5eb77331fc580cbd13612c
squid-4.4-5.module+el8.0.0+4045+70edde92.src.rpm SHA-256: 59786225933fa0eccb0198020f2cae96712e0360dc4504a8a554f7bcc8213974
ppc64le
libecap-1.0.1-2.module+el8.0.0+4045+70edde92.ppc64le.rpm SHA-256: 657de3e3e4a444780b59c70c273ccdea1736b8fcfc2a580a95034b61053d2705
libecap-debuginfo-1.0.1-2.module+el8.0.0+4045+70edde92.ppc64le.rpm SHA-256: 2bd7ef9a93d4fac1a1ddaf40d99c68afac8fcbfa2a961c25de0083fc9b93a73d
libecap-debugsource-1.0.1-2.module+el8.0.0+4045+70edde92.ppc64le.rpm SHA-256: 8dddef3970468cb9fbd548caa9389fb042193b1796fdc8806a5a4f8d962265bd
libecap-devel-1.0.1-2.module+el8.0.0+4045+70edde92.ppc64le.rpm SHA-256: 5ea10381f634253627a9c1aad4474a0fbb1eff3effd636254bfb60bd348df4d7
squid-4.4-5.module+el8.0.0+4045+70edde92.ppc64le.rpm SHA-256: bb0b2b5da023d5702db14c633796213b6fdf18a8e9381a8244e0251045fb2eb1
squid-debuginfo-4.4-5.module+el8.0.0+4045+70edde92.ppc64le.rpm SHA-256: f92830d6416968f03f320c8503d88eb5ab237fbb4ae61a309aa103669f022ac8
squid-debugsource-4.4-5.module+el8.0.0+4045+70edde92.ppc64le.rpm SHA-256: d60cfc4e939898c843e522d1d66a2a29ca3b900b4d581ad29431dbc6d7be8a94

Red Hat Enterprise Linux for ARM 64 8

SRPM
libecap-1.0.1-2.module+el8.0.0+4045+70edde92.src.rpm SHA-256: 4c7a3e66334fa0e3781d1d9925fac22ece7577b17a5eb77331fc580cbd13612c
squid-4.4-5.module+el8.0.0+4045+70edde92.src.rpm SHA-256: 59786225933fa0eccb0198020f2cae96712e0360dc4504a8a554f7bcc8213974
aarch64
libecap-1.0.1-2.module+el8.0.0+4045+70edde92.aarch64.rpm SHA-256: 259424def74348f36a6eeab1352310ca795aa167086e28684f12a3a97f32c533
libecap-debuginfo-1.0.1-2.module+el8.0.0+4045+70edde92.aarch64.rpm SHA-256: 4bbceb25e5c1cf207cf740437a04e2592924bbc98c0ec181d121ebcbcb29619d
libecap-debugsource-1.0.1-2.module+el8.0.0+4045+70edde92.aarch64.rpm SHA-256: 4edfe45baf45923df7a03d2b675b9bc312ec5366f5640496b9d3774406d90659
libecap-devel-1.0.1-2.module+el8.0.0+4045+70edde92.aarch64.rpm SHA-256: d09eb4719e955f1c65963378175bf3f29dcd733dfa736b3e21f2a24bbf392973
squid-4.4-5.module+el8.0.0+4045+70edde92.aarch64.rpm SHA-256: 838f17a6de23d19fd1d5313fc107a6444c9df05ff9a7829a094ce048f96b8351
squid-debuginfo-4.4-5.module+el8.0.0+4045+70edde92.aarch64.rpm SHA-256: 926e215e057b5ff195ee0ece60ed84a395c3ba032f1059094f214c915528cfe2
squid-debugsource-4.4-5.module+el8.0.0+4045+70edde92.aarch64.rpm SHA-256: 12ae5be0607b068ff090f8c74626ff5c0610c4e7346b832bce8409d6c30acb37

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.