Vulnerability Details : CVE-2019-12529

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages.
Published 2019-07-11 19:15:13
Updated 2022-04-26 20:22:19
Source MITRE
View at NVD,   CVE.org

Threat overview for CVE-2019-12529

Top countries where our scanners detected CVE-2019-12529
Top open port discovered on systems with this issue 3128
IPs affected by CVE-2019-12529 2,327,406
Threat actors abusing to this issue? Yes
Find out if you* are affected by CVE-2019-12529!
*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2019-12529

Probability of exploitation activity in the next 30 days: 0.74%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 79 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2019-12529

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source
4.3
 MEDIUM AV:N/AC:M/Au:N/C:P/I:N/A:N
8.6
2.9
 NIST
5.9
 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
2.2
3.6
 NIST

CWE ids for CVE-2019-12529

  • The product reads data past the end, or before the beginning, of the intended buffer.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-12529

Products affected by CVE-2019-12529

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close