# openSUSE-SU-2021:0016-1: Security update for privoxy


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 4 Jan 2021

## What is openSUSE-SU-2021:0016-1?

openSUSE-SU-2021:0016-1 is a vulnerability in privoxy, published on 4 Jan 2021. 

### Official description

This update for privoxy fixes the following issues:

privoxy was updated to 3.0.29:

* Fixed memory leaks when a response is buffered and the buffer
  limit is reached or Privoxy is running out of memory.
  OVE-20201118-0001
* Fixed a memory leak in the show-status CGI handler when
  no action files are configured
  OVE-20201118-0002
* Fixed a memory leak in the show-status CGI handler when
  no filter files are configured
  OVE-20201118-0003
* Fixes a memory leak when client tags are active
  OVE-20201118-0004
* Fixed a memory leak if multiple filters are executed
  and the last one is skipped due to a pcre error
  OVE-20201118-0005
* Prevent an unlikely dereference of a NULL-pointer that
  could result in a crash if accept-intercepted-requests
  was enabled, Privoxy failed to get the request destination
  from the Host header and a memory allocation failed.
  OVE-20201118-0006
* Fixed memory leaks in the client-tags CGI handler when
  client tags are configured and memory allocations fail.
  OVE-20201118-0007
* Fixed memory leaks in the show-status CGI handler when memory
  allocations fail
  OVE-20201118-0008
* Add experimental https inspection support
* Use JIT compilation for static filtering for speedup
* Add support for Brotli decompression, add
  'no-brotli-accepted' filter which prevents the use of 
  Brotli compression
* Add feature to gather exended statistics
* Use IP_FREEBIND socket option to help with failover
* Allow to use extended host patterns and vanilla host patterns
  at the same time by prefixing extended host patterns with
  'PCRE-HOST-PATTERN:'
* Added 'Cross-origin resource sharing' (CORS) support
* Add SOCKS5 username/password support
* Bump the maximum number of action and filter files
  to 100 each
* Fixed handling of filters with 'split-large-forms 1'
  when using the CGI editor.
* Better detect a mismatch of connection details when
  figuring out whether or not a connection can be reused
* Don't send a 'Connection failure' message instead of the
  'DNS failure' message
* Let LOG_LEVEL_REQUEST log all requests
* Improvements to default Action file

License changed to GPLv3.

- remove packaging vulnerability boo#1157449

This update was imported from the openSUSE:Leap:15.1:Update update project.

## Which versions are affected by openSUSE-SU-2021:0016-1?


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `privoxy` | SUSE:Package Hub 15 SP1 | All versions | 3.0.29-bp151.3.3.1 |

## How do I fix openSUSE-SU-2021:0016-1?

Upgrade to a fixed version.

## Is openSUSE-SU-2021:0016-1 being exploited?

There is no known exploitation of openSUSE-SU-2021:0016-1 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for openSUSE-SU-2021:0016-1 and fix it if it is affected.

What it is: openSUSE-SU-2021:0016-1 is a vulnerability in privoxy, published on 4 Jan 2021. 
Exploitation: There is no known exploitation of openSUSE-SU-2021:0016-1 in the wild and no public exploit code.

Affected product: privoxy. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/openSUSE-SU-2021-0016-1/ (Markdown: https://insights.sbomify.com/openSUSE-SU-2021-0016-1/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/openSUSE-SU-2021:0016-1

---
From sbomify Insights: https://insights.sbomify.com/openSUSE-SU-2021-0016-1/
Summaries are generated and may contain mistakes; the official description above is the record.