CVE-2020-15049

Name of the Vulnerable Software and Affected Versions Squid versions prior to 4.12 Squid versions 5.x prior to 5.0.3

Description An issue in the http/ContentLengthInterpreter.cc component of Squid allows for a Request Smuggling and Poisoning attack against the HTTP cache. This can be achieved by sending an HTTP request with a Content-Length header containing specific characters, such as "+-" or uncommon shell whitespace character prefixes to the length field-value. The attack can be exploited by a remote attacker to poison the cache content using a specially crafted HTTP(S) request.

Recommendations For Squid versions prior to 4.12, update to version 4.12 or later to resolve the issue. For Squid versions 5.x prior to 5.0.3, update to version 5.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the http/ContentLengthInterpreter.cc component until a patch is available.