CVE-2019-12528
high · 7.5An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes.
7.5
CVSS
10.5%
EPSS (exploit prob.)
96th
EPSS percentile
2020-02-04
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| squid-cache | squid | < 4.10 |
| fedoraproject | fedora | 30 |
| fedoraproject | fedora | 31 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| opensuse | leap | 15.1 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 19.10 |
Check a specific version with /api/v1/cve/match.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html
- http://www.squid-cache.org/Advisories/SQUID-2020_2.txt
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6W2IQ7QV2OGREFFUBNVZIDD3RJBDE4R/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TSU6SPANL27AGK5PCGBJOKG4LUWA555J/
- https://security.gentoo.org/glsa/202003-34
- https://usn.ubuntu.com/4289-1/
- https://www.debian.org/security/2020/dsa-4682
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html
- http://www.squid-cache.org/Advisories/SQUID-2020_2.txt
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6W2IQ7QV2OGREFFUBNVZIDD3RJBDE4R/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TSU6SPANL27AGK5PCGBJOKG4LUWA555J/
- https://security.gentoo.org/glsa/202003-34
- https://usn.ubuntu.com/4289-1/
- https://www.debian.org/security/2020/dsa-4682
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2019-12528