CVE-2016-4554

Published: May 10, 2016Modified: May 6, 2026

8.6

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 4.0

Source: NVD

Description

mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue.

Affected (7)

Products: Oracle: Linux · Squid Cache: Squid · Canonical: Ubuntu Linux

1 product

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Oracle Linux	Version 6
Oracle Linux	Version 7

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Squid Cache Squid	Up to 3.5.17

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10
Canonical Ubuntu Linux	Version 16.04

Related CWEs

CWE-345

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (34)

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html

Source: cve@mitre.org

http://www.debian.org/security/2016/dsa-3625

Source: cve@mitre.org

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Source: cve@mitre.org

Third Party Advisory

http://www.securitytracker.com/id/1035769

Source: cve@mitre.org

Third Party Advisory

http://www.squid-cache.org/Advisories/SQUID-2016_8.txt

Source: cve@mitre.org

Vendor Advisory

http://www.squid-cache.org/Versions/v3/3.1/changesets/SQUID-2016_8.patch

Source: cve@mitre.org

Patch

http://www.squid-cache.org/Versions/v3/3.2/changesets/SQUID-2016_8.patch

Source: cve@mitre.org

Patch

http://www.squid-cache.org/Versions/v3/3.3/changesets/SQUID-2016_8.patch

Source: cve@mitre.org

Patch

http://www.squid-cache.org/Versions/v3/3.4/changesets/SQUID-2016_8.patch

Source: cve@mitre.org

Patch

http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2016_8.patch

Source: cve@mitre.org

Patch

http://www.ubuntu.com/usn/USN-2995-1

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2016:1138

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2016:1139

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2016:1140

Source: cve@mitre.org

https://security.gentoo.org/glsa/201607-01

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html