Squid vulnerability: SQUID-2023:1 Request/Response smuggling in HTTP/1.1 and ICAP

SashLi

There is a critical vulnerability in the actual package version. Any plans for the fix / patch files ?

Due to chunked decoder lenience Squid is vulnerable to
Request/Response smuggling attacks when parsing HTTP/1.1
and ICAP messages.

Workaround:

ICAP issues can be reduced by ensuring only trusted ICAP
services are used, with TLS encrypted connections
(ICAPS extension).

There is no workaround for the HTTP Request Smuggling issue.

CVSS Score of 9.3

Github:
SQUID-2023:1 Request/Response smuggling in HTTP/1.1 and ICAP

mr_snow

There are also two other critical vulnerabilities:

mr_snow

I just filed a ticket for this hoping that it gets more attention: https://redmine.pfsense.org/issues/14926

mr_snow

My ticket was finally rejected because Squid will be removed in the next major version: https://www.netgate.com/blog/deprecation-of-squid-add-on-package-for-pfsense-software