medium6.1
CVE-2019-18860
Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.
Impact
Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Squid-Cache | Squid | before 4.9 |
| Debian | Debian Linux | Versions 9.0, 10.0 |
| Canonical | Ubuntu Linux | Versions 16.04, 18.04, 19.10, 20.04 |
| Opensuse | Leap | Version 15.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html
- https://github.com/squid-cache/squid/pull/504
- https://github.com/squid-cache/squid/pull/505
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://usn.ubuntu.com/4356-1/
- https://www.debian.org/security/2020/dsa-4732
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html
- http://www.openwall.com/lists/oss-security/2025/11/04/7
- http://www.openwall.com/lists/oss-security/2025/11/05/1
- http://www.openwall.com/lists/oss-security/2025/11/05/7
- https://github.com/squid-cache/squid/pull/504
- https://github.com/squid-cache/squid/pull/505
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://usn.ubuntu.com/4356-1/
- https://www.debian.org/security/2020/dsa-4732