vulnerability
Debian: CVE-2019-12522: squid -- security update
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:L/AC:M/Au:S/C:P/I:P/A:P) | Apr 15, 2020 | May 15, 2025 | May 27, 2025 |
Severity
4
CVSS
(AV:L/AC:M/Au:S/C:P/I:P/A:P)
Published
Apr 15, 2020
Added
May 15, 2025
Modified
May 27, 2025
Description
An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root.
Solution
no-fix-debian-deb-package
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.