CVE-2019-12527

A flaw was discovered in Squid versions 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data but does not check that the decoded length is not greater than the buffer. This flaw leads to a heap-based buffer overflow with user-controlled data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Deny ftp:// protocol URLs being proxied and Cache Manager report access to all clients:

acl FTP proto FTP
http_access deny FTP
http_access deny manager