CVE-2004-0189
Fixed in a distro release EPSS 14%
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.
Products: squid
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | squid | 2.5.5-1 |
| Debian 13 | squid | 2.5.5-1 |
| Debian 14 | squid | 2.5.5-1 |
| Debian 3.0 | squid | 2.4.6-2woody2 |
| Red Hat Enterprise Linux 3 | squid | 7:2.5.STABLE3-5.3E |
| Red Hat Enterprise Linux 3 | squid-debuginfo | 7:2.5.STABLE3-5.3E |