{
  "threat_severity" : "Moderate",
  "public_date" : "2019-11-05T00:00:00Z",
  "bugzilla" : {
    "description" : "squid: Cross-Site Request Forgery issue in HTTP Request processing",
    "id" : "1770365",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1770365"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.4",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-79",
  "details" : [ "An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2020-11-04T00:00:00Z",
    "advisory" : "RHSA-2020:4743",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "squid:4-8030020200828070549.30b713e6"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Out of support scope",
    "package_name" : "squid",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "squid",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "squid34",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Will not fix",
    "package_name" : "squid",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2019-18677\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-18677\nhttp://www.squid-cache.org/Advisories/SQUID-2019_9.txt" ],
  "name" : "CVE-2019-18677",
  "mitigation" : {
    "value" : "As per upstream:\nRemove append_domain configuration settings from squid.conf.\nThe append_domain feature is redundant when /etc/resolv.conf  is used to determine hostnames. However, please note that use of /etc/resolv.conf may require removal of dns_nameservers and other redundant DNS directives.",
    "lang" : "en:us"
  },
  "csaw" : false
}