CVE-2019-12521

Name
CVE-2019-12521
Description
An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Third Party Advisory https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12521.txt
Mailing List http://www.openwall.com/lists/oss-security/2020/04/23/1
Third Party Advisory https://www.debian.org/security/2020/dsa-4682
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html
Third Party Advisory https://security.gentoo.org/glsa/202005-05
Third Party Advisory https://usn.ubuntu.com/4356-1/
Mailing List https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
Third Party Advisory https://security.netapp.com/advisory/ntap-20210205-0006/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:* squid >= 3.0 <= 3.5.28
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:* squid >= 4.0 <= 4.7
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:* squid >= 5.0 <= 5.0.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
squid edge-main 3.5.27-r2 None possibly vulnerable
squid 3.22-main 3.5.27-r2 None possibly vulnerable
squid 3.21-main 3.5.27-r2 None possibly vulnerable
squid 3.20-main 3.5.27-r2 None possibly vulnerable
squid 3.19-main 3.5.27-r2 None possibly vulnerable
squid 3.11-main 4.11-r0 None fixed
squid 3.10-main 4.11-r0 None fixed