Squid Cache Proxy Vulnerability

Squid is a caching proxy for the Web, used to improve performance and reduce load on web servers. This vulnerability allows information disclosure due to a failure to redact HTTP authentication credentials in error handling, potentially allowing remote clients to identify security tokens or credentials used internally by a web application using Squid for backend load balancing.

You're affected if you use Squid. Affected versions: 7.2 If you don't recognise this software, you're probably not affected.

To fix this vulnerability, upgrade to Squid version 7.2 or later. Alternatively, as a workaround:

• Disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.
  • URL: https://www.squid-cache.org/Documentation/squidconf/SquidConfVariables/#email_err_data

• Patch
• Third Party Advisory
• www.openwall.com