Vulnerability · Published Feb 4, 2020 · Assigned by mitre
CVE-2020-8449
High 7.5
In plain English
A high-severity security flaw in the libecap package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.3% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)8.3%top 5.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libecap | 1.0.1-2.module_el8.6.0+2741+01592ae8 | ALSA-2020:4743 |
| AlmaLinux:8 | libecap-devel | 1.0.1-2.module_el8.6.0+2741+01592ae8 | ALSA-2020:4743 |
| Alpine:v3.20 | squid | 4.10-r0 | ALPINE-CVE-2020-8449 |
| Alpine:v3.21 | squid | 4.10-r0 | ALPINE-CVE-2020-8449 |
| Alpine:v3.22 | squid | 4.10-r0 | ALPINE-CVE-2020-8449 |
| Alpine:v3.23 | squid | 4.10-r0 | ALPINE-CVE-2020-8449 |
| Alpine:v3.24 | squid | 4.10-r0 | ALPINE-CVE-2020-8449 |
| Debian:12 | squid | 4.10-1 | DEBIAN-CVE-2020-8449 |
| Debian:13 | squid | 4.10-1 | DEBIAN-CVE-2020-8449 |
| Debian:14 | squid | 4.10-1 | DEBIAN-CVE-2020-8449 |
| Rocky Linux:8 | libecap | 0:1.0.1-2.module+el8.4.0+404+316a0dc5 | RLSA-2020:4743 |
Affected products (as reported)
References
- http://www.squid-cache.org/Advisories/SQUID-2020_1.txt x_refsource_MISC
- http://www.squid-cache.org/Versions/v4/changesets/squid-4-d8e4715992d0e530871519549add5519cbac0598.patch x_refsource_MISC
- http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-8e657e835965c3a011375feaa0359921c5b3e2dd.patch x_refsource_MISC
- http://www.squid-cache.org/Versions/v4/changesets/squid-4-b3a0719affab099c684f1cd62b79ab02816fa962.patch x_refsource_MISC
- http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_1.patch x_refsource_MISC
- http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2020_1.patch x_refsource_MISC
- USN-4289-1 vendor-advisory, x_refsource_UBUNTU
- openSUSE-SU-2020:0307 vendor-advisory, x_refsource_SUSE
- GLSA-202003-34 vendor-advisory, x_refsource_GENTOO
- FEDORA-2020-ab8e7463ab vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-790296a8f4 vendor-advisory, x_refsource_FEDORA
- openSUSE-SU-2020:0606 vendor-advisory, x_refsource_SUSE
- DSA-4682 vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20200710 [SECURITY] [DLA 2278-1] squid3 security update mailing-list, x_refsource_MLIST
- https://security.netapp.com/advisory/ntap-20210304-0002/ x_refsource_CONFIRM