安全公告/【CVE-2019-12521】

基本信息

漏洞名称:
受影响操作系统:Asianux
危险等级:中危
影响源码包:squid
CVSS评分:5.9
发现日期:2022-09-13
修复版本:4.9-11

漏洞描述

An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within the same structure so it can't affect adjacent memory blocks, and thus just leads to a crash while processing.

修复方式

yum update PackageName

漏洞判定

执行命令yum info PackageName获取软件包版本号，版本小于修复版本，则受此漏洞影响，版本大于等于修复版本，则此漏洞已修复

补丁

参考

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12521
https://nvd.nist.gov/vuln/detail/CVE-2019-12521