CVE-2019-12522: 
Squid vulnerability analysis and mitigation

An issue was discovered in Squid through version 4.7. When Squid is run as root, it spawns its child processes as a lesser user (by default the user 'nobody') via the leave_suid call. The vulnerability exists because leave_suid leaves the Saved UID as 0, which could allow privilege escalation (NVD).

The vulnerability is related to improper privilege management (CWE-269) in Squid's process handling. When Squid spawns child processes with reduced privileges, the Saved UID remains set to 0 (root), creating a security weakness. The vulnerability has a CVSS v3.1 Base Score of 4.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L (NVD).

If exploited, this vulnerability allows an attacker who has compromised a child process to escalate their privileges back to root, potentially gaining full system access. This could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS) (NetApp Advisory).

The vulnerability requires local access and high complexity to exploit. An attacker would first need to compromise a child process before being able to leverage the saved UID to escalate privileges (NVD).

According to Debian Security Tracker, there is no upstream plan to fix the issue as architectural changes would be needed to resolve it without breaking some installations. The issue only causes problems if some other vulnerability is used to compromise the proxy (Debian Tracker).