CVE-2019-12529

CVE-2019-12529 is a medium-severity vulnerability in Squid-cache Squid with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-125.

Key facts

Description

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages.

Frequently asked questions

What is CVE-2019-12529?
An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages.
How severe is CVE-2019-12529?
CVE-2019-12529 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2019-12529 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 8% (94th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-12529?
CVE-2019-12529 primarily affects Squid-cache Squid. In total, 20 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2019-12529?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2019-12529 published?
CVE-2019-12529 was published on 2019-07-11 and last updated on 2026-06-17.

References

Affected products (20)

More vulnerabilities in Squid-cache Squid

All CVEs affecting Squid-cache Squid →

Other CWE-125 (Out-of-bounds Read) vulnerabilities

Browse all CWE-125 (Out-of-bounds Read) vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE: