CVE-2020-15049

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
30/06/2020
Last modified:
07/11/2023

Description

An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:* 2.0 (including) 2.6 (including)
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:* 3.1 (including) 3.5.28 (including)
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:* 4.0 (including) 4.12 (excluding)
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:* 5.0 (including) 5.0.3 (excluding)
cpe:2.3:a:squid-cache:squid:2.7:*:*:*:*:*:*:*
cpe:2.3:a:squid-cache:squid:2.7:stable2:*:*:*:*:*:*
cpe:2.3:a:squid-cache:squid:2.7:stable3:*:*:*:*:*:*
cpe:2.3:a:squid-cache:squid:2.7:stable4:*:*:*:*:*:*
cpe:2.3:a:squid-cache:squid:2.7:stable5:*:*:*:*:*:*
cpe:2.3:a:squid-cache:squid:2.7:stable6:*:*:*:*:*:*
cpe:2.3:a:squid-cache:squid:2.7:stable7:*:*:*:*:*:*
cpe:2.3:a:squid-cache:squid:2.7:stable8:*:*:*:*:*:*
cpe:2.3:a:squid-cache:squid:2.7:stable9:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*