Advisories » MGASA-2015-0347

Updated squid packages fix CVE-2015-5400

Publication date: 08 Sep 2015
Modification date: 08 Sep 2015
Type: security
Affected Mageia releases : 5
CVE: CVE-2015-5400

Description

Updated squid packages fix security vulnerability:

Alex Rousskov discovered that Squid configured with cache_peer and operating
on explicit proxy traffic does not correctly handle CONNECT method peer
responses. In some configurations, it allows remote clients to bypass security
in an explicit gateway proxy (CVE-2015-5400).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=16304
• http://www.squid-cache.org/Advisories/SQUID-2015_2.txt
• https://www.debian.org/security/2015/dsa-3327
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5400

SRPMS

5/core

• squid-3.4.13-1.1.mga5