CVE-2020-15810

Name	CVE-2020-15810
Description	An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2394-1, DSA-4751-1, ELA-294-1
Debian Bugs	968934

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
squid (PTS)	buster (security), buster, buster (lts)	4.6-1+deb10u10	fixed
	bullseye (security), bullseye	4.13-10+deb11u3	fixed
	bookworm (security), bookworm	5.7-2+deb12u2	fixed
	sid, trixie	6.12-1	fixed
squid3 (PTS)	jessie, jessie (lts)	3.5.23-5+deb8u7	fixed
	stretch (security)	3.5.23-5+deb9u7	fixed
	stretch (lts), stretch	3.5.23-5+deb9u10	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
squid	source	buster	4.6-1+deb10u4	DSA-4751-1
squid	source	(unstable)	4.13-1		968934
squid3	source	jessie	3.5.23-5+deb8u2	ELA-294-1
squid3	source	stretch	3.5.23-5+deb9u5	DLA-2394-1
squid3	source	(unstable)	(unfixed)

Notes

https://github.com/squid-cache/squid/security/advisories/GHSA-3365-q9qx-f98m
Squid 4: http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_10.patch