Security update for squid

Announcement ID:	SUSE-SU-2019:2975-1
Rating:	important
References:	bsc#1133089 bsc#1140738 bsc#1141329 bsc#1141330 bsc#1141332 bsc#1141442 bsc#1156323 bsc#1156324 bsc#1156326 bsc#1156328 bsc#1156329
Cross-References:	CVE-2019-12523 CVE-2019-12525 CVE-2019-12526 CVE-2019-12527 CVE-2019-12529 CVE-2019-12854 CVE-2019-13345 CVE-2019-18676 CVE-2019-18677 CVE-2019-18678 CVE-2019-18679 CVE-2019-3688
CVSS scores:	CVE-2019-12523 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2019-12523 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2019-12525 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-12525 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-12525 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-12526 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-12526 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-12527 ( SUSE ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-12527 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-12527 ( NVD ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-12529 ( SUSE ): 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2019-12529 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-12529 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-12854 ( SUSE ): 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2019-12854 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-12854 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-13345 ( SUSE ): 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2019-13345 ( NVD ): 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2019-18676 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-18676 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-18677 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2019-18677 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2019-18678 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N CVE-2019-18678 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2019-18679 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-18679 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-3688 ( SUSE ): 5.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVE-2019-3688 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected Products:	Server Applications Module 15-SP1 Server Applications Module 15 SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise High Performance Computing 15 SP1 SUSE Linux Enterprise Real Time 15 SP1 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15 SP1 SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Manager Proxy 4.0 SUSE Manager Retail Branch Server 4.0 SUSE Manager Server 4.0

An update that solves 12 vulnerabilities can now be installed.

Description:

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

• CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
• CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
• CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
• CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
• CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
• CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed:

• Fixed DNS failures when peer name was configured with any upper case characters
• Fixed several rock cache_dir corruption issues

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Server Applications Module 15
  zypper in -t patch SUSE-SLE-Module-Server-Applications-15-2019-2975=1
• Server Applications Module 15-SP1
  zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP1-2019-2975=1

Package List:

• Server Applications Module 15 (aarch64 ppc64le s390x x86_64)
  • squid-debugsource-4.9-5.11.1
  • squid-debuginfo-4.9-5.11.1
  • squid-4.9-5.11.1
• Server Applications Module 15-SP1 (aarch64 ppc64le s390x x86_64)
  • squid-debugsource-4.9-5.11.1
  • squid-debuginfo-4.9-5.11.1
  • squid-4.9-5.11.1

References:

• https://www.suse.com/security/cve/CVE-2019-12523.html
• https://www.suse.com/security/cve/CVE-2019-12525.html
• https://www.suse.com/security/cve/CVE-2019-12526.html
• https://www.suse.com/security/cve/CVE-2019-12527.html
• https://www.suse.com/security/cve/CVE-2019-12529.html
• https://www.suse.com/security/cve/CVE-2019-12854.html
• https://www.suse.com/security/cve/CVE-2019-13345.html
• https://www.suse.com/security/cve/CVE-2019-18676.html
• https://www.suse.com/security/cve/CVE-2019-18677.html
• https://www.suse.com/security/cve/CVE-2019-18678.html
• https://www.suse.com/security/cve/CVE-2019-18679.html
• https://www.suse.com/security/cve/CVE-2019-3688.html
• https://bugzilla.suse.com/show_bug.cgi?id=1133089
• https://bugzilla.suse.com/show_bug.cgi?id=1140738
• https://bugzilla.suse.com/show_bug.cgi?id=1141329
• https://bugzilla.suse.com/show_bug.cgi?id=1141330
• https://bugzilla.suse.com/show_bug.cgi?id=1141332
• https://bugzilla.suse.com/show_bug.cgi?id=1141442
• https://bugzilla.suse.com/show_bug.cgi?id=1156323
• https://bugzilla.suse.com/show_bug.cgi?id=1156324
• https://bugzilla.suse.com/show_bug.cgi?id=1156326
• https://bugzilla.suse.com/show_bug.cgi?id=1156328
• https://bugzilla.suse.com/show_bug.cgi?id=1156329