CVE-2020-15049: fedoraproject fedora HTTP Request/Response Smuggling
Vulnerability summary
CVE-2020-15049 is a critical (CVSS 9.9) HTTP Request/Response Smuggling vulnerability in fedoraproject fedora. EPSS estimates a 5.71% chance of exploitation in the next 30 days, higher than 92.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 12 · Related 8Timeline
- 30-06-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
5.71%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 5.71% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse15 products
- squid&distro=HPE Helion OpenStack 8< 3.5.21-26.29.1
- squid&distro=SUSE Enterprise Storage 5< 3.5.21-26.29.1
- squid&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 3.5.21-26.29.1
- squid&distro=SUSE Linux Enterprise Server 12 SP2-LTSS< 3.5.21-26.29.1
- squid&distro=SUSE Linux Enterprise Server 12 SP3-BCL< 3.5.21-26.29.1
Ubuntu2 products
- squid< 4.10-1ubuntu1.3
- squid3< 3.5.12-1ubuntu7.15 | < 3.5.27-1ubuntu1.9
Alpine1 product
- squid≥ 2.0, < 4.12.0-r0
Debian1 product
- squid< 4.12-1
Fedoraproject1 product
- fedoraEOL31
Squid-cache1 product
- squidEOL≥ 2.0, ≤ 2.6 | ≥ 3.1, ≤ 3.5.28 | ≥ 4.0, < 4.12 | ≥ 5.0, < 5.0.3 | 2.7 | 2.7:stable2 | 2.7:stable3 | 2.7:stable4 | 2.7:stable5 | 2.7:stable6 | 2.7:stable7 | 2.7:stable8 | 2.7:stable9
6 vendors · 21 products
References
19 links- www.squid-cache.org/Versions/v4/changesets/squid-4-ea12a34d338b962707d5078d6d1fc7c6eb119a22.patchX Refsource MISCPatchVendor Advisory
- www.squid-cache.org/Versions/v5/changesets/squid-5-485c9a7bb1bba88754e07ad0094647ea57a6eb8d.patchX Refsource MISCPatchVendor Advisory
- github.com/squid-cache/squid/security/advisories/GHSA-qf3v-rc95-96j5X Refsource CONFIRMREPORTThird Party Advisory
- security.netapp.com/advisory/ntap-20210312-0001/X Refsource CONFIRM