Description
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE9-setcookie ↗
- http://fedoranews.org/updates/FEDORA--.shtml ↗
- http://www.securityfocus.com/bid/12716 ↗
- https://usn.ubuntu.com/93-1/ ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19581 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11169 ↗
- http://www.redhat.com/support/errata/RHSA-2005-415.html ↗