VDB
ALPINE-CVE-2019-18679
ALPINE-CVE-2019-18679
PUBLISHED
CVSS 7.5 HIGH
An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.14 | squid | 0, 2.7.6-r0, 2.7.6-r1 |
| Alpine:v3.11 | squid | 4.2-r1, 2.0, 0 |
| Alpine:v3.18 | squid | 2.7.6-r10, 2.0, 0 |
| Alpine:v3.17 | squid | 3.5.16-r0, 2.0, 0 |
| Alpine:v3.9 | squid | 0, 2.0, 0 |
| Alpine:v3.16 | squid | 2.7.6-r8, 0, 2.0 |
| Alpine:v3.20 | squid | 0, 3.5.14-r1, 3.5.15-r0 |
| Alpine:v3.10 | squid | 3.5.28-r0, 2.7.6-r1, 2.7.6-r10 |
| Alpine:v3.23 | squid | 3.4.6-r0, 0, 2.0 |
| Alpine:v3.15 | squid | 3.5.22-r0, 3.5.6-r1, 3.5.7-r0 |
| Alpine:v3.13 | squid | 3.5.6-r0, 3.5.6-r1, 3.5.7-r0 |
| Alpine:v3.22 | squid | 3.2.0.13-r0, 3.2.0.12-r3, 3.2.0.12-r2 |
| Alpine:v3.19 | squid | 2.7.7-r2, 2.0, 0 |
| Alpine:v3.21 | squid | 3.5.5-r0, 3.5.6-r1, 3.5.7-r0 |
| Alpine:v3.24 | squid | 0, 2.0 |
| Alpine:v3.12 | squid | 0, 2.7.6-r5, 2.7.7-r1 |
Timeline
- Nov 26, 2019 CVE Published
- Apr 30, 2026 Distribution Patch
- Jul 8, 2026 CVE Updated