CVE-2020-25097: debian debian_linux Improper Input Validation
CVSS: 8.6v3.1HighModified
AliasesALPINE-CVE-2020-25097RHSA-2021:1135RHSA-2021:1979RHSA-2021:2025UBUNTU-CVE-2020-25097DEBIAN-CVE-2020-25097DLA-2598-1DSA-4873-1
Published 19-03-2021Last modified 04-08-2024
Vulnerability summary
CVE-2020-25097 is a high (CVSS 8.6) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 7.34% chance of exploitation in the next 30 days, higher than 94.3% of scored vulnerabilities.
CVSS score
8.6/10
010
High · v3.1 (NVD)EPSS score
7.34%
0%100%
Low · -0.82 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 9 · Related 8Timeline
- 19-03-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.6Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- OSV · Red hatEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
7.34%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
-0.82 pp
From 8.16% on 18-09-2026
18-09-202618-10-2026
EPSS score7.34%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Affected systems
Redhat9 products
- libecap< 0:1.0.1-2.module+el8.1.0+4044+36416a77
- libecap-debuginfo< 0:1.0.1-2.module+el8.1.0+4044+36416a77
- libecap-debugsource< 0:1.0.1-2.module+el8.1.0+4044+36416a77
- libecap-devel< 0:1.0.1-2.module+el8.1.0+4044+36416a77
- squid< 7:3.5.20-17.el7_9.6 | < 7:4.11-4.module+el8.4.0+10676+a969168e.2 | < 7:4.4-8.module+el8.1.0+10584+c769fd35.3 | < 7:4.4-8.module+el8.2.0+10583+6e4ac934.3
Debian3 products
- squid< 4.13-8 | < 4.6-1+deb10u5
- squid3< 3.5.23-5+deb9u6
- debian_linuxEOL10.0
Ubuntu2 products
- squid< 4.10-1ubuntu1.3
- squid3< 3.5.12-1ubuntu7.16 | < 3.5.27-1ubuntu1.10
Alpine1 product
- squid≥ 2.0, < 4.14-r0 | ≥ 2.0, < 5.0.5-r0
Fedoraproject1 product
- fedoraEOL32 | 33 | 34
Netapp1 product
Squid-cache1 product
- squid≥ 2.0, < 4.14 | ≥ 5.0.1, < 5.0.5
7 vendors · 18 products
References
24 links- github.com/squid-cache/squid/security/advisories/GHSA-jvf6-h9gj-pmj6X Refsource MISCARTICLEREPORTPatchThird Party Advisory
- www.squid-cache.org/Versions/v4/changesets/SQUID-2020_11.patchX Refsource MISCMailing ListPatchVendor Advisory
- www.squid-cache.org/Versions/v5/changesets/SQUID-2020_11.patchX Refsource MISCMailing ListPatchVendor Advisory
