CVE-2020-8517: canonical ubuntu_linux Improper Input Validation
Vulnerability summary
CVE-2020-8517 is a high (CVSS 7.5) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 6.85% chance of exploitation in the next 30 days, higher than 93.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 12 · Related 11Timeline
- 04-02-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of service for all clients using the proxy.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
6.85%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 6.85% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Ubuntu2 products
- squid< 4.9-2ubuntu4
- squid3< 3.5.12-1ubuntu7.10 | < 3.5.27-1ubuntu1.5
Alpine1 product
- squid< 4.10-r0 | < 3.5.27-r4
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 19.10
Debian1 product
- squid< 4.10-1
Opensuse1 product
- leapEOL15.1
Squid-cache1 product
- squid< 4.10
6 vendors · 7 products
References
13 links- www.squid-cache.org/Versions/v4/changesets/squid-4-6982f1187a26557e582172965e266f544ea562a5.patchX Refsource MISCPatchVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
