CVE-2020-15049: 
Squid vulnerability analysis and mitigation

CVE-2020-15049 is a vulnerability discovered in Squid versions before 4.12 and 5.x before 5.0.3, specifically in the http/ContentLengthInterpreter.cc component. The vulnerability was discovered in June 2020 by Alex Rousskov of The Measurement Factory, with independent discovery by Amit Klein of Safebreach (GitHub Advisory).

The vulnerability allows a Request Smuggling and Poisoning attack against the HTTP cache. The attack vector involves a client sending an HTTP request with a Content-Length header containing '+\ '-' or an uncommon shell whitespace character prefix to the length field-value. The vulnerability has been assigned a CVSS Score of 9.3, indicating critical severity (GitHub Advisory).

When successfully exploited, this vulnerability allows a trusted client to perform request smuggling and poison the HTTP cache contents with crafted HTTP(S) request messages. The attack requires an upstream server to participate in the smuggling and generate the poison response sequence, though most popular server software are not vulnerable to participation in this attack (GitHub Advisory).

The vulnerability requires a trusted client status to exploit, and the attack must involve an upstream server participating in the smuggling to generate the poison response sequence. The vulnerability has been confirmed to affect all Squid-2.x up to and including 2.7.STABLE9, all Squid-3.x up to and including 3.5.28, all Squid-4.x up to and including 4.11, and Squid-5.0.1 and 5.0.2 (GitHub Advisory).

The vulnerability has been fixed in Squid versions 4.12 and 5.0.3. There are no workarounds available for this vulnerability, and users are strongly recommended to upgrade to the patched versions. Patches addressing this problem for stable releases can be found in the Squid patch archives (GitHub Advisory, Red Hat Advisory).