CVE-2020-25097

Name of the Vulnerable Software and Affected Versions: Squid versions 4.13 and earlier Squid versions 5.x through 5.0.4

Description: The issue is related to the implementation of the uri whitespace configuration in the Squid proxy server, which is associated with insufficient input validation. This can allow a remote attacker to send a hidden HTTP request, also known as an HTTP Request Smuggling attack, potentially accessing services that are otherwise forbidden by security controls.

Recommendations: For Squid versions 4.13 and earlier, update to a version that includes the fix for this issue. For Squid versions 5.x through 5.0.4, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of the uri whitespace configuration setting until a patch is available.