7bfda7c216
Update squid4 to 4.13 (Squid 4.13). Here is release announce: The Squid HTTP Proxy team is very pleased to announce the availability of the Squid-4.13 release! This release is a security release resolving several issues found in the prior Squid releases. The major changes to be aware of: * SQUID-2020:8 HTTP(S) Request Splitting (CVE-2020-15811) This problem is serious because it allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. See the advisory for patches: <https://github.com/squid-cache/squid/security/advisories/GHSA-c7p8-xqhm-49wv> * SQUID-2020:9 Denial of Service processing Cache Digest Response (CVE pending allocation) This problem allows a trusted peer to deliver to perform Denial of Service by consuming all available CPU cycles on the machine running Squid when handling a crafted Cache Digest response message. This attack is limited to Squid using cache_peer with cache digests feature. See the advisory for patches: <https://github.com/squid-cache/squid/security/advisories/GHSA-vvj7-xjgq-g2jg> * SQUID-2020:10 HTTP(S) Request Smuggling (CVE-2020-15810) This problem is serious because it allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. See the advisory for patches: <https://github.com/squid-cache/squid/security/advisories/GHSA-3365-q9qx-f98m> * Bug 5051: Some collapsed revalidation responses never expire This bug appears as a 4xx or 5xx status response becoming the only response delivered by Squid to a URL when Collapsed Forwarding feature is used. It primarily affects Squid which are caching the 4xx/5xx status object since Bug 5030 fix in Squid-4.11. But may have been occurring for short times on any proxy with Collapsed Forwarding. * SSL-Bump: Support parsing GREASEd (and future) TLS handshakes Chrome Browser intentionally sends random garbage values in the TLS handshake to force TLS implementations to cope with future TLS extensions cleanly. The changes in Squid-4.12 to disable TLS/1.3 caused our parser to be extra strict and reject this TLS garbage. This release adds explicit support for Chrome, or any other TLS agent performing these "GREASE" behaviours. * Honor on_unsupported_protocol for intercepted https_port This behaviour was one of the intended use-cases for unsupported protocol handling, but somehow was not enabled earlier. Squid should now be able to perform the on_unsupported_protocol selected action for any traffic handled by SSL-Bump. All users of Squid are urged to upgrade as soon as possible. See the ChangeLog for the full list of changes in this and earlier releases. Please refer to the release notes at http://www.squid-cache.org/Versions/v4/RELEASENOTES.html when you are ready to make the switch to Squid-4
16 lines
1.2 KiB
Text
16 lines
1.2 KiB
Text
$NetBSD: distinfo,v 1.9 2020/08/23 09:51:35 taca Exp $
|
|
|
|
SHA1 (squid-4.13.tar.xz) = cac95c18789e9ecd6620c2f278fc3900498c065b
|
|
RMD160 (squid-4.13.tar.xz) = e49c1b0c6154a3ec0c1ce84e1d9c1c76733cefc1
|
|
SHA512 (squid-4.13.tar.xz) = 06807f82ed01e12afe2dd843aa0a94f69c351765b1889c4c5c3da1cf2ecb06ac3a4be6a24a62f04397299c8fc0df5397f76f64df5422ff78b37a9382d5fdf7fc
|
|
Size (squid-4.13.tar.xz) = 2452752 bytes
|
|
SHA1 (patch-compat_compat.h) = 839381a5e1f46e7d9b822bbb53d82a53c996ddc0
|
|
SHA1 (patch-configure) = 0d204989666c36172f0765f2a44766d9194c7bb2
|
|
SHA1 (patch-errors_Makefile.in) = 84cbf5c836f02ed5fbfff140888c6d3aadeac326
|
|
SHA1 (patch-src_Makefile.in) = afc5aefd97c46d1ffab43e97aeaeade3a5a8c648
|
|
SHA1 (patch-src_acl_external_kerberos__ldap__group_support__resolv.cc) = 0ea41d55e32d689a16e012391a9eea67631daf3a
|
|
SHA1 (patch-src_comm_ModKqueue.cc) = d8c5d235f07a48731275101d60fcbf2e22f77b96
|
|
SHA1 (patch-src_esi_VarState.cc) = d9418e59cdc390b2d970195167a99bb7ed392c38
|
|
SHA1 (patch-src_fs_ufs_RebuildState.h) = 76ee5c437b3dad05e428ae89cd5af6c052a40e59
|
|
SHA1 (patch-src_security_Handshake.cc) = 5c48ab63e7e387ff14e3a0a2d9cddfeef66782ec
|
|
SHA1 (patch-tools_Makefile.in) = d098c0c9dc4af577f74e562d99f07ed98be5ae01
|