[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <46e47266-347a-4ebd-a400-86267ead39ac@treenet.co.nz>
Date: Wed, 5 Nov 2025 15:43:02 +1300
From: Amos Jeffries <squid3@...enet.co.nz>
To: oss-security@...ts.openwall.com
Subject: Re: [CVE-2019-18860] SQUID-2023:6 Cross Site Scripting
in cachemgr.cgi
On 05/11/2025 13:09, Solar Designer wrote:
> Hi,
>
> Thank you for posting this, but I'm afraid it is confusing:
>
> On Wed, Nov 05, 2025 at 11:26:14AM +1300, Amos Jeffries wrote:
>> Squid Proxy Cache Security Update Advisory SQUID-2023:6
>
>> Advisory ID: | SQUID-2023:6 (CVE-2019-18860)
>> Date: | November 5, 2025
>
> OK, so it's an advisory from 2023 for a CVE from 2019 (or for an issue
> first disclosed in 2019), which was updated in 2025. This brings up the
> question of what those updates in 2025 are...
Okay, to clarify;
The 2025 change is a new patch for the secondary attack vector reported
in 2020. Which should have been part of Squid v6.7 cachemgr.cgi and
sadly omitted. Mea culpa on that.
That omission means *all* cachemgr.cgi released by the Squid Project
have been vulnerable and need the new v6 patch applied.
If the previous v4 patch for this CVE was applied, then it will still
need the new one applied on top.
The tool is no longer published upstream, so there will not be an
officially fixed version released.
>
>> Revision history:
>>
>> 2019-10-18 20:15:14 UTC Initial Report
>> 2019-11-03 16:22:22 UTC Initial Patches Released
>> 2020-03-31 11:07:35 UTC Additional Report
>
> ...but the revision history starts in 2019 (before the advisory year?!)
> and ends in 2020.
>
(oops, thanks I have updated the github text)
Cheers
Amos
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
