CVE-2019-12524: canonical ubuntu_linux
Vulnerability summary
CVE-2019-12524 is a critical (CVSS 9.8) vulnerability in canonical ubuntu_linux. EPSS estimates a 3.86% chance of exploitation in the next 30 days, higher than 90% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 6 · Related 3Timeline
- 15-04-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the url_regex check, and gain access to the blocked resource.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.86%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
-0.39 pp
From 4.25% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- squid< 4.8-1
- debian_linuxEOL9.0 | 10.0
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04
Squid-cache1 product
- squid≤ 4.7
Ubuntu1 product
- squid3< 3.5.27-1ubuntu1.7
4 vendors · 5 products
References
10 links- gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12524.txtX Refsource MISCThird Party AdvisoryREPORT
- lists.debian.org/debian-lts-announce/2020/07/msg00009.htmlMailing ListX Refsource MLISTThird Party Advisory