* [Buildroot] [PATCH 1/1] package/squid: security bump to version 4.11
@ 2020-05-06 20:15 Fabrice Fontaine
2020-05-07 21:16 ` Thomas Petazzoni
2020-05-10 19:31 ` Peter Korsgaard
0 siblings, 2 replies; 3+ messages in thread
From: Fabrice Fontaine @ 2020-05-06 20:15 UTC (permalink / raw)
To: buildroot
Fix CVE-2020-11945: An issue was discovered in Squid before 5.0.2. A
remote attacker can replay a sniffed Digest Authentication nonce to gain
access to resources that are otherwise forbidden. This occurs because
the attacker can overflow the nonce reference counter (a short integer).
Remote code execution may occur if the pooled token credentials are
freed (instead of replayed as valid credentials).
http://www.squid-cache.org/Advisories/SQUID-2020_4.txt
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
package/squid/squid.hash | 8 ++++----
package/squid/squid.mk | 2 +-
2 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/package/squid/squid.hash b/package/squid/squid.hash
index 765e67cf3d..3c8ab64d35 100644
--- a/package/squid/squid.hash
+++ b/package/squid/squid.hash
@@ -1,6 +1,6 @@
-# From http://www.squid-cache.org/Versions/v4/squid-4.10.tar.xz.asc
-md5 af7ac6e70f9bd03ae4fcec0c9b99c38a squid-4.10.tar.xz
-sha1 b8b267771550bb8c7f2b2968b305118090e7217a squid-4.10.tar.xz
+# From http://www.squid-cache.org/Versions/v4/squid-4.11.tar.xz.asc
+md5 10f34e852153a9996aa4614670e2bda1 squid-4.11.tar.xz
+sha1 053277bf5497163ffc9261b9807abda5959bb6fc squid-4.11.tar.xz
# Locally calculated
-sha256 98f0100afd8a42ea5f6b81eb98b0e4b36d7a54beab1c73d2f1705ab49b025f1f squid-4.10.tar.xz
+sha256 4ed947612410263f57ad0e39bfd087e60fb714f028d7d3b0e469943efd34287d squid-4.11.tar.xz
sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING
diff --git a/package/squid/squid.mk b/package/squid/squid.mk
index aeaec425e4..d281eee3ed 100644
--- a/package/squid/squid.mk
+++ b/package/squid/squid.mk
@@ -4,7 +4,7 @@
#
################################################################################
-SQUID_VERSION = 4.10
+SQUID_VERSION = 4.11
SQUID_SOURCE = squid-$(SQUID_VERSION).tar.xz
SQUID_SITE = http://www.squid-cache.org/Versions/v4
SQUID_LICENSE = GPL-2.0+
--
2.26.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH 1/1] package/squid: security bump to version 4.11
2020-05-06 20:15 [Buildroot] [PATCH 1/1] package/squid: security bump to version 4.11 Fabrice Fontaine
@ 2020-05-07 21:16 ` Thomas Petazzoni
2020-05-10 19:31 ` Peter Korsgaard
1 sibling, 0 replies; 3+ messages in thread
From: Thomas Petazzoni @ 2020-05-07 21:16 UTC (permalink / raw)
To: buildroot
On Wed, 6 May 2020 22:15:41 +0200
Fabrice Fontaine <fontaine.fabrice@gmail.com> wrote:
> Fix CVE-2020-11945: An issue was discovered in Squid before 5.0.2. A
> remote attacker can replay a sniffed Digest Authentication nonce to gain
> access to resources that are otherwise forbidden. This occurs because
> the attacker can overflow the nonce reference counter (a short integer).
> Remote code execution may occur if the pooled token credentials are
> freed (instead of replayed as valid credentials).
>
> http://www.squid-cache.org/Advisories/SQUID-2020_4.txt
>
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> ---
> package/squid/squid.hash | 8 ++++----
> package/squid/squid.mk | 2 +-
> 2 files changed, 5 insertions(+), 5 deletions(-)
Applied to master, thanks.
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH 1/1] package/squid: security bump to version 4.11
2020-05-06 20:15 [Buildroot] [PATCH 1/1] package/squid: security bump to version 4.11 Fabrice Fontaine
2020-05-07 21:16 ` Thomas Petazzoni
@ 2020-05-10 19:31 ` Peter Korsgaard
1 sibling, 0 replies; 3+ messages in thread
From: Peter Korsgaard @ 2020-05-10 19:31 UTC (permalink / raw)
To: buildroot
>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:
> Fix CVE-2020-11945: An issue was discovered in Squid before 5.0.2. A
> remote attacker can replay a sniffed Digest Authentication nonce to gain
> access to resources that are otherwise forbidden. This occurs because
> the attacker can overflow the nonce reference counter (a short integer).
> Remote code execution may occur if the pooled token credentials are
> freed (instead of replayed as valid credentials).
> http://www.squid-cache.org/Advisories/SQUID-2020_4.txt
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Committed to 2020.02.x, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-05-10 19:31 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-06 20:15 [Buildroot] [PATCH 1/1] package/squid: security bump to version 4.11 Fabrice Fontaine
2020-05-07 21:16 ` Thomas Petazzoni
2020-05-10 19:31 ` Peter Korsgaard
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.