Debian Patches

Status for squid/5.7-2+deb12u6

Patch Description Author Forwarded Bugs Origin Last update
0001-Default-configuration-file-for-debian.patch Default configuration file for debian Luigi Gangitano <luigi@debian.org> no 2016-10-29
0002-Change-default-file-locations-for-debian.patch Change default file locations for debian Luigi Gangitano <luigi@debian.org> no 2016-10-29
0003-installed-binary-for-debian-ci.patch Use installed squid binary for Debian CI testing
===================================================================		 Amos Jeffries <amosjeffries@squid-cache.org> no 2018-07-21
0005-Use-RuntimeDirectory-to-create-run-squid.patch Use RuntimeDirectory to create /run/squid
Instead of installing the /run/squid directory, which goes against
Debian Policy, we instruct systemd to automatically create it for us
when the service is started.		 Sergio Durigan Junior <sergiodj@debian.org> no 2020-05-11
CVE-2023-46724.patch CVE-2023-46724 Markus Koschany <apo@debian.org> no debian http://www.squid-cache.org/Versions/v5/SQUID-2023_4.patch 2024-02-19
CVE-2023-46846.patch CVE-2023-46846 Markus Koschany <apo@debian.org> no debian http://www.squid-cache.org/Versions/v5/SQUID-2023_1.patch 2024-02-19
CVE-2023-46847.patch CVE-2023-46847 Markus Koschany <apo@debian.org> no debian http://www.squid-cache.org/Versions/v5/SQUID-2023_3.patch 2024-02-19
CVE-2023-46848.patch CVE-2023-46848 Markus Koschany <apo@debian.org> no debian http://www.squid-cache.org/Versions/v5/SQUID-2023_5.patch 2024-02-19
CVE-2023-49285.patch CVE-2023-49285 Markus Koschany <apo@debian.org> no http://www.squid-cache.org/Versions/v5/SQUID-2023_7.patch 2024-02-19
CVE-2023-49286.patch CVE-2023-49286 Markus Koschany <apo@debian.org> no http://www.squid-cache.org/Versions/v6/SQUID-2023_8.patch 2024-02-19
CVE-2023-50269.patch CVE-2023-50269 Markus Koschany <apo@debian.org> no debian http://www.squid-cache.org/Versions/v5/SQUID-2023_10.patch 2024-02-19
CVE-2024-23638.patch CVE-2024-23638 Markus Koschany <apo@debian.org> no http://www.squid-cache.org/Versions/v5/SQUID-2023_11.patch 2024-02-19
CVE-2024-25111.patch CVE-2024-25111 Markus Koschany <apo@debian.org> no http://www.squid-cache.org/Versions/v6/SQUID-2024_1.patch 2024-03-05
CVE-2024-25617.patch CVE-2024-25617 Markus Koschany <apo@debian.org> no http://www.squid-cache.org/Versions/v6/SQUID-2024_2.patch 2024-03-05
CVE-2024-37894.patch Bug 5378: type mismatch in libTrie (#1830)
TrieNode::add() incorrectly computed an offset of an internal data
structure, resulting in out-of-bounds memory accesses that could cause
corruption or crashes.

This bug was discovered and detailed by Joshua Rogers at
https://megamansec.github.io/Squid-Security-Audit/esi-underflow.html
where it was filed as "Buffer Underflow in ESI".		 Francesco Chemolli <5175948+kinkie@users.noreply.github.com> no 2024-06-02
CVE-2025-54574_CVE-2023-5824.patch Bug 5318: peer_digest.cc:399: "fetch->pd && receivedData.data" (#1584) Alex Rousskov <rousskov@measurement-factory.com> no 2023-11-20
CVE-2025-62168.patch Bug 3390: Proxy auth data visible to scripts (#2249) Amos Jeffries <yadij@users.noreply.github.com> no 2025-10-11
CVE-2023-46728.patch Remove support for Gopher protocol (#1092)
Gopher code quality remains too low for production use in most
environments. The code is a persistent source of vulnerabilities and
fixing it requires significant effort. We should not be spending scarce
Project resources on improving that code, especially given the lack of
strong demand for Gopher support.

With this change, Gopher requests will be handled like any other request
with an unknown (to Squid) protocol. For example, HTTP requests with
Gopher URI scheme result in ERR_UNSUP_REQ.

Default Squid configuration still considers TCP port 70 "safe". The
corresponding Safe_ports ACL rule has not been removed for consistency
WAIS requests:

acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais		 Alex Rousskov <rousskov@measurement-factory.com> yes upstream backport, https://github.com/squid-cache/squid/commit/6ea12e8fb590ac6959e9356a81aa3370576568c3 2022-07-26
CVE-2025-59362.patch Fix ASN.1 encoding of long SNMP OIDs (#2149) Alex Rousskov <rousskov@measurement-factory.com> yes upstream https://github.com/squid-cache/squid/commit/0d89165ee6da10e6fa50c44998b3cd16d59400e9 2025-08-30
CVE-2026-50012.patch Harden peerDigestSwapInMask against invalid cache digest reply (#2423)
A cache_digest on-the-wire size may be bigger than the mask_size declared
in the digest itself. peerDigestSwapInMask() copied the received bytes into
the fixed-size pd->cd->mask buffer without checking that they fit, allowing
a malicious/broken peer to overflow the heap-allocated mask buffer.

Ignore (abort the fetch for) the digest in case this happens.

This backport squashes the two upstream commits that constitute the fix:

origin: https://github.com/squid-cache/squid/commit/19fcfe922717c8b255270c032dcde4071c003bcd
origin: https://github.com/squid-cache/squid/commit/2c89b9b4054ad14ea191bc7cd35f969feba8df53

The second commit ("Fix -Wsign-compare on arm32 (#2432)") reworks the bounds
check to be signedness-safe on both 32- and 64-bit platforms; its final form
is what is applied here.


Bookworm adaptation: upstream uses finishAndDeleteFetch(), which does not
exist in 5.7 (the wrapper-removal refactor is not backported); the equivalent
peerDigestFetchAbort() helper is used instead. base/Assure.h (already present
in this package via the CVE-2025-54574 backport) is included explicitly.		 Francesco Chemolli <5175948+kinkie@users.noreply.github.com> yes upstream 2026-05-30
CVE-2026-47729.patch Improve parsing of certain FTP directory listing formats (#2408) (#2409)
This surgical fix restricts parsing to the input buffer when the listing
entry date in "TypeA" or "TypeB" formats is not followed by a filename.
It does not improve rendering of listings with missing filenames or the
overall quality of FTP listing parsing code.

C strchr() always returns a non-nil pointer when given a NUL character,
so its callers must be careful not to supply a NUL character if a
"natural" one-of-the-regular-c-string-characters membership test is
required. Here *copyFrom could be the terminating NUL, in which case the
loop/if walked copyFrom past the end of the input buffer (out-of-bounds
read).

The bug was probably introduced in 1997 commit 3fdadc70 and then
duplicated in 2017 commit 3d872090.


The 5.7 ftpListParseParts() code is identical to the code fixed upstream,
so the change applies unmodified.		 squidadm <squidadm@users.noreply.github.com> yes upstream https://github.com/squid-cache/squid/commit/865a131c7d557e68c965043d98c2eccae26deef8 2026-05-17
CVE-2026-33526.patch Do not escape malformed URI twice when sending ICP errors (#2374)
In this context, escaping escaped URI always produces incorrect URI
because `%` character in the escaped URI gets escaped again. Feeding the
result of the first rfc1738_escape() call to the second call is also
dangerously wrong because the result of the first call gets invalidated
during the second call.

rfc1738_do_escape() returns a pointer into a static buffer that it may
xfree() and reallocate when the input is long enough (strlen(url)*3 >
bufsize). In the second call, url already points into that static buffer,
so the buffer being read is freed mid-call -> heap use-after-free. A
remote client can trigger this via a crafted ICP query URL containing
whitespace (so the first escape runs) whose escaped form grows enough to
force the reallocation. This is CVE-2026-33526 (affects deployments with
a non-zero icp_port; not mitigable via icp_access).

No other cases of such "chained" rfc1738_escape() calls were found.

Broken since 2002 commit e6ccf245.


The 5.7 icpGetRequest() contains the identical vulnerable pattern (it only
differs by using NULL instead of nullptr on the following return), so the
single-line deletion applies as-is.		 Joshua Rogers <megamansec@gmail.com> yes upstream https://github.com/squid-cache/squid/commit/8a7d42f9d44befb8fcbbb619505587c8de6a1e91 2026-02-10
CVE-2026-33515.patch ICP: Fix validation of packet sizes and URLs (#2220)
Fix handling of malformed ICP queries and replies instead of passing
invalid URL pointer to consumers, leading to out-of-bounds memory reads
and other problems. These fixes affect both ICP v2 and ICP v3 traffic.

* Reject packets with URLs that are not NUL-terminated.
* Reject packets with URLs containing embedded NULs or trailing garbage.

The above two restrictions may backfire if popular ICP agents do send
such malformed URLs, and we will need to do more to handle them
correctly, but it is _safe_ to reject them for now.

Also protect icpHandleUdp() from dereferencing a nil icpOutgoingConn
pointer. It is not clear whether icpHandleUdp() can be exposed to nil
icpOutgoingConn in current code. More work is needed to polish this.

This is CVE-2026-33515 (out-of-bounds read; affects deployments with a
non-zero icp_port). The new icpGetUrl() relies on header.length being
bounded by the received datagram length: icpHandleIcpV2()/icpHandleIcpV3()
already reject packets where len != header.length before dispatching to
doV2Query()/doV3Query()/handleReply(), and icpHandleUdp() NUL-terminates
buf at buf[len], so every icpGetUrl() read stays within the received bytes.


Bookworm adaptation: applied on top of the CVE-2026-33526 (#2374) backport,
which upstream also precedes this commit. Adjusted to 5.7 code that uses
NULL (not nullptr) and full parameter names in src/tests/stub_icp.cc; the
icpDenyAccess() body in 5.7 differs but only its signature is changed here.
All const-qualification changes are behaviour-preserving: the 5.7 callees
(FromUrlXXX, StoreEntry::getPublic, icpGetCacheKey, clientdbUpdate,
clientdbCutoffDenied, neighborsUdpAck) already accept const arguments.		 Joshua Rogers <MegaManSec@users.noreply.github.com> yes upstream https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165 2026-02-12
1f13f721263a4cc75e4b798a230022561047899c.patch Bug 5162: mgr:index URL do not produce MGR_INDEX template (#1191)

Satisfy mgr:index requests using

* a 200 OK response with a body derived from the MGR_INDEX template (if
that template file was found during (re)configuration) or
* a 404 (Not Found) error response (otherwise).

Broken in 2019 commit 7e6eabb, when Squid started replying using a 200
OK response with a hard-coded "mgr_index" text as a body, ignoring any
configured MGR_INDEX template.		 Eduard Bagdasaryan <eduard.bagdasaryan@measurement-factory.com> no 2022-12-01
edad3f150de8af0aeb2f629508be3219b83369b9.patch ext_kerberos_ldap_group_acl: Support -b with -D (#1207)
When both '-b' (i.e. bind DN) and '-D' (i.e. Kerberos domain) options
are specified, '-b' is ignored completely. This breaks the helper when a
search subtree has to be limited (e.g., when using FreeIPA).

Fix it to take '-b' into account if it was specified with '-D'.		 Alexander Bokovoy <abokovoy@redhat.com> no 2022-12-10

All known versions for source package 'squid'

Links