Alert.png The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @


From EGIWiki
Jump to navigation Jump to search
Main page Software Security Checklist Issue Handling Advisories Notes On Risk Advisory Template More


Title:       EGI SVG 'ADVISORY' [TLP:WHITE] HIGH risk Frontier-Squid-4 vulnerability [EGI-SVG-2019-15849]

Date:       2019-07-26
Updated     2019-11-11 TLP changed to white and placed on wiki

Affected software and risk

HIGH risk Frontier-Squid vulnerability

Package : frontier-squid-4.*

See OSG security team information provided below.

Actions required/recommended

Sites running frontier-squid-4.* should upgrade at least to frontier-squid-4.4-2.1, available in UMD-4 both for CentOS 7 and SL6. 
 Further details are provided below.

OSG security team information

The frontier-squid package has a publicly announced security vulnerability that can potentially enable remote code execution 
from any IP address that access control allows to use the squid.  All sites that have frontier-squid-4.* versions should 
upgrade urgently, especially those that have squids that can be used from the internet.




Due to incorrect buffer management, squid is vulnerable to a heap overflow and possible remote code execution attack when 
processing HTTP Authentication credentials. This happens when squid is asked to proxy ftp, which it allows by default.


If you have frontier-squid-4.* installed, upgrade to a version where the vulnerability is removed.  
OSG has released frontier-squid-4.4-2.1 which only adds a patch for this problem to version 4.4-1.1. 
Upstream had previously released 4.6 versions which are also vulnerable. The upstream frontier-squid-4.8-1.1 version 
fixes this problem in addition to including other features and bug fixes. So upgrade to either version OSG 
frontier-squid-4.4-2.1 or upstream 4.8-1.1.



Further information for EGI sites

The vulnerability in frontier-squid-4.* originates from squid-4.*, which is unlikely to be in use at EGI sites, 
because the squid versions that come with CentOS 7 and SL6 are still in the 3.* series, which do not have the vulnerability.

Sites running squid-4.* should either upgrade or downgrade to a version that does not have the vulnerability (see [1]),
 or change to frontier-squid-4.4-2.1 or 4.8-1.1.


** AMBER information - Limited distribution 
     - see for distribution restrictions **  


Minor updates may be made without re-distribution to the sites


Comments or questions should be sent to svg-rat  at

If you find or become aware of another vulnerability which is relevant to EGI you may report it by e-mail to  

report-vulnerability at
the EGI Software Vulnerability Group will take a look according to the procedure defined in [R 3]  

Note that this is undergoing revision to fully handle vulnerabilities in the EOSC-hub era. 


[R 3]


SVG was alerted to this vulnerability by David Dykstra from FNAL / OSG.

Yyyy-mm-dd  [EGI-SVG-2019-15849] 

2019-07-17 SVG alerted to this issue by David Dykstra
2019-07-17 Acknowledgement from the EGI SVG to the reporter
2019-07-18 Decision to wait for pending updates of the OSG and UMD repositories.
2019-07-25 OSG prepared announcement of the vulnerability with actions to take.
2019-07-26 SVG informed sites as 'AMBER', incorporating the OSG information.
2019-11-11 TLP changed to [WHITE] and placed on SVG public wiki


This advisory has been prepared as part of the effort to fulfil EGI SVG's purpose 
"To minimize the risk to the EGI infrastructure arising from software vulnerabilities"

The risk is that assessed by the group, according to the EGI SVG issue handling procedure [R 3]  in the context of how the 
software is used in the EGI infrastructure. It is the opinion of the group, we do not guarantee it to be correct. 
The risk may also be higher or lower in other deployments depending on how the software is used.   

Others may re-use this information provided they:-

1) Respect the provided TLP classification

2) Credit the EGI Software Vulnerability Group

Note that the SVG issue handling procedure is currently under review, to take account of the increasing inhomogeneity 
of the EGI infrastructure and the services in the EOSC-hub catalogue.

On behalf of the EGI SVG,