CVE-2019-12528
squid: Information Disclosure issue in FTP Gateway
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · February 2, 2020
Updated · November 21, 2025
Description
A flaw was found in squid. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
As a workaround, it is possible to disable support for FTP. In order to do so, remove the following line from your squid configuration file: acl Safe_ports 21
Then add the following lines to your squid configuration file: acl FTP proto FTP http_access deny FTP
CVSS / CWE
CVSS 3.1 · 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor