Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2020-15811

Incorrect Comparison

Published: Sep 02, 2020 | Modified: Nov 21, 2024
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:N/I:P/A:N
RedHat/V2
RedHat/V3
9.6 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Ubuntu
LOW
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2020-15811
CWEhttps://cwe.mitre.org/data/definitions/697.html

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.

Weakness

The product compares two entities in a security-relevant context, but the comparison is incorrect.

Affected Software

NameVendorStart VersionEnd Version
SquidSquid-cache*4.13 (excluding)
SquidSquid-cache5.0 (including)5.0.4 (excluding)
Red Hat Enterprise Linux 7RedHatsquid-7:3.5.20-17.el7_9.4*
Red Hat Enterprise Linux 8RedHatsquid:4-8020020200827100059.4cda2c84*
Red Hat Enterprise Linux 8.0 Update Services for SAP SolutionsRedHatsquid:4-8000020200827105727.f8e95b4e*
Red Hat Enterprise Linux 8.1 Extended Update SupportRedHatsquid:4-8010020200827104751.c27ad7f8*
SquidUbuntudevel*
SquidUbuntuesm-infra/focal*
SquidUbuntufocal*
SquidUbuntugroovy*
SquidUbuntuhirsute*
SquidUbuntutrusty*
Squid3Ubuntubionic*
Squid3Ubuntuesm-infra/bionic*
Squid3Ubuntuesm-infra/xenial*
Squid3Ubuntuprecise/esm*
Squid3Ubuntutrusty*
Squid3Ubuntuxenial*

Extended Description

This Pillar covers several possibilities:

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use