squid3 (3.5.12-1ubuntu7.15) xenial-security; urgency=medium
* SECURITY UPDATE: Request Smuggling and Poisoning issue
- debian/patches/CVE-2020-15049.patch: validate Content-Length value
prefix in src/http/ContentLengthInterpreter.cc,
src/http/ContentLengthInterpreter.h.
- CVE-2020-15049
* SECURITY UPDATE: HTTP Request Smuggling issue
- debian/patches/CVE-2020-15810.patch: enforce token characters for
field-name in src/HttpHeader.cc.
- CVE-2020-15810
* SECURITY UPDATE: HTTP Request Splitting issue
- debian/patches/CVE-2020-15811-pre.patch: validate Content-Length
header values in src/HttpHeader.cc, src/HttpHeaderTools.cc,
src/HttpHeaderTools.h, src/http/ContentLengthInterpreter.cc,
src/http/ContentLengthInterpreter.h, src/http/Makefile.am.
- debian/patches/CVE-2020-15811.patch: Improve Transfer-Encoding
handling in src/HttpHeader.cc, src/HttpHeader.h, src/client_side.cc,
src/http.cc.
- CVE-2020-15811
* SECURITY UPDATE: DoS via peer crafted Cache Digest response message
- debian/patches/CVE-2020-24606.patch: fix livelocking in
peerDigestHandleReply in src/peer_digest.cc.
- CVE-2020-24606
* Enable the test suite
- debian/rules: enable test suite
- debian/patches/enable-the-test-suite.patch: fix FTBFS.
- debian/patches/fix-stub-comm-test.patch: fix FTBFS.
squid3 (3.5.12-1ubuntu7.14) xenial; urgency=medium
* d/squid.resolvconf: Invoke "systemctl reload --no-block" if we are
using systemd. This prevents squid from blocking if the reload
action is being issued indirectly because of another
service (e.g., because dnsmasq has been restarted), which may
cause a deadlock and prevent the whole transaction to
complete. (LP: #1761096)
Date: 2020-09-16 17:08:19.299343+00:00
Changed-By: Marc Deslauriers <marc.deslauri...@canonical.com>
https://launchpad.net/ubuntu/+source/squid3/3.5.12-1ubuntu7.15
Sorry, changesfile not available.
--
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/xenial-changes
