CVE-2020-15049 Other in n/a
Attackers can perform HTTP request smuggling and cache poisoning by manipulating Content-Length headers, affecting Squid proxy users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15049?
CVE-2020-15049 is a critical vulnerability in Fedoraproject Fedora, published on 30 Jun 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value.
Weakness: CWE-444
Which versions are affected by CVE-2020-15049?
It affects 2 products.
Linux distribution packages (15)
squid SUSE:Enterprise Storage 5 | All versions | 3.5.21-26.29.1 |
squid SUSE:HPE Helion OpenStack 8 | All versions | 3.5.21-26.29.1 |
squid SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 3.5.21-26.29.1 |
squid SUSE:Linux Enterprise Server 12 SP2-LTSS | All versions | 3.5.21-26.29.1 |
squid SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 3.5.21-26.29.1 |
squid SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 3.5.21-26.29.1 |
squid SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 3.5.21-26.29.1 |
squid SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 3.5.21-26.29.1 |
squid SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 3.5.21-26.29.1 |
squid SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 3.5.21-26.29.1 |
squid SUSE:OpenStack Cloud 7 | All versions | 3.5.21-26.29.1 |
squid SUSE:OpenStack Cloud 8 | All versions | 3.5.21-26.29.1 |
squid SUSE:OpenStack Cloud 9 | All versions | 3.5.21-26.29.1 |
squid SUSE:OpenStack Cloud Crowbar 8 | All versions | 3.5.21-26.29.1 |
squid SUSE:OpenStack Cloud Crowbar 9 | All versions | 3.5.21-26.29.1 |
Products include Fedoraproject Fedora, Squid-Cache Squid.
How do I fix CVE-2020-15049?
Upgrade to a fixed version.
Is CVE-2020-15049 being exploited?
There is no known exploitation of CVE-2020-15049 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2020-15049, DEBIAN-CVE-2020-15049, GHSA-qf3v-rc95-96j5, SUSE-SU-2020:1946-1, UBUNTU-CVE-2020-15049.