CVE-2019-12529: canonical ubuntu_linux Out-of-bounds Read
Vulnerability summary
CVE-2019-12529 is a medium (CVSS 5.9) Out-of-bounds Read vulnerability in canonical ubuntu_linux. EPSS estimates a 8.09% chance of exploitation in the next 30 days, higher than 94.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 14 · Related 8Timeline
- 11-07-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · AlpineEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
8.09%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 8.09% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- squid< 4.8-1
- debian_linuxEOL8.0 | 9.0 | 10.0
Alpine1 product
- squid≥ 2.0, < 4.8-r0
Canonical1 product
- ubuntu_linuxEOL12.04 | 16.04 | 18.04 | 19.04
Fedoraproject1 product
- fedoraEOL29
Opensuse1 product
- leapEOL15.0 | 15.1
Squid-cache1 product
- squid≥ 2.0, < 2.7 | ≥ 3.0, ≤ 3.5.28 | ≥ 4.0, ≤ 4.7 | 2.7:stable1 | 2.7:stable2 | 2.7:stable3 | 2.7:stable4 | 2.7:stable5 | 2.7:stable6 | 2.7:stable7 | 2.7:stable8 | 2.7:stable9
Ubuntu1 product
- squid3< 3.5.12-1ubuntu7.8 | < 3.5.27-1ubuntu1.3
7 vendors · 8 products
References
19 links- www.squid-cache.org/Versions/v4/changesets/squid-4-dd46b5417809647f561d8a5e0e74c3aacd235258.patchX Refsource CONFIRMPatchVendor Advisory
lists.debian.org/debian-lts-announce/2019/07/msg00018.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2019-11/msg00053.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 19 references
- lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/07/msg00009.htmlMailing ListX Refsource MLISTThird Party Advisory