CVE-2020-8449

HIGH

Squid <4.10 - SSRF

Title source: llm

Description

An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.

References (15)

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html

[Patch, Vendor Advisory] http://www.squid-cache.org/Advisories/SQUID-2020_1.txt

[Patch, Vendor Advisory] http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2020_1.patch

[Patch, Vendor Advisory] http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-8e657e835965c3a011375feaa0359921c5b3e2dd.patch

[Patch, Vendor Advisory] http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_1.patch

[Patch, Vendor Advisory] http://www.squid-cache.org/Versions/v4/changesets/squid-4-b3a0719affab099c684f1cd62b79ab02816fa962.patch

[Patch, Vendor Advisory] http://www.squid-cache.org/Versions/v4/changesets/squid-4-d8e4715992d0e530871519549add5519cbac0598.patch

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html

[Third Party Advisory] https://security.gentoo.org/glsa/202003-34

[Third Party Advisory] https://security.netapp.com/advisory/ntap-20210304-0002/

[Third Party Advisory] https://usn.ubuntu.com/4289-1/

[Third Party Advisory] https://www.debian.org/security/2020/dsa-4682

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6W2IQ7QV2OGREFFUBNVZIDD3RJBDE4R/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TSU6SPANL27AGK5PCGBJOKG4LUWA555J/

Scores

CVSS v3 7.5

EPSS 0.0352

EPSS Percentile 87.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-668

Status published

Affected Products (9)

squid-cache/squid < 4.10

debian/debian_linux

canonical/ubuntu_linux

opensuse/leap

fedoraproject/fedora

Timeline

Published Feb 04, 2020

Tracked Since Feb 18, 2026