]> git.ipfire.org Git - thirdparty/squid.git/commit
Fix cache_peer login=PASS(THRU) after CVE-2015-5400
authorAmos Jeffries <squid3@treenet.co.nz>
Sat, 26 Sep 2015 03:04:01 +0000 (20:04 -0700)
committerAmos Jeffries <squid3@treenet.co.nz>
Sat, 26 Sep 2015 03:04:01 +0000 (20:04 -0700)
commit971003b0b122cfb0b48c21202e7b3cdd8374c785
treebad2deefa363d66eaffe339c415ce6115bf2eb0f
parent53a97f656258545d33425818350d4c09787fc391
Fix cache_peer login=PASS(THRU) after CVE-2015-5400

The patch for CVE-2015-5400 converts all non-200 peer responses
into 502 Bad Gateway responses when relaying a CONNECT to a peer.

This happens to break login=PASS and login=PASSTHRU behaviour
which relies on the 401 and 407 status being relayed transparently.

We need to relay the auth server responses as-is when login= is
set to PASS or PASSTHRU but then unconditionally close the
connections to prevent CVE-2015-5400 from occuring.
src/tunnel.cc