Version in base suite: 6.13-2+deb13u3 Base version: squid_6.13-2+deb13u3 Target version: squid_6.13-2+deb13u4 Base file: /srv/ftp-master.debian.org/ftp/pool/main/s/squid/squid_6.13-2+deb13u3.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/s/squid/squid_6.13-2+deb13u4.dsc changelog | 16 ++++ patches/CVE-2026-104786.patch | 121 ++++++++++++++++++++++++++++++++++ patches/CVE-2026-61642.patch | 46 ++++++++++++ patches/CVE-2026-62846-523ed3b0.patch | 30 ++++++++ patches/icap-username-encoding.patch | 23 ++++++ patches/series | 4 + 6 files changed, 240 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp6l6vjst7/squid_6.13-2+deb13u3.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp6l6vjst7/squid_6.13-2+deb13u4.dsc: no acceptable signature found diff -Nru squid-6.13/debian/changelog squid-6.13/debian/changelog --- squid-6.13/debian/changelog 2026-09-03 20:51:56.000000000 +0000 +++ squid-6.13/debian/changelog 2026-10-30 13:28:27.000000000 +0000 @@ -1,3 +1,19 @@ +squid (6.13-2+deb13u4) trixie-security; urgency=high + + * Non-maintainer upload. + * CVE-2026-61642: Reject prohibited bare identity Transfer-Encoding. + Add debian/patches/CVE-2026-61642.patch. + * CVE-2026-104786: Bound HTTP authentication credential encodings. + Add debian/patches/CVE-2026-104786.patch. + * SQUID-2026:8: Bound ICAP authentication annotation encodings. + Add debian/patches/CVE-2026-104786.patch. + * ICAP username encoding follow-up: Bound the independent X-Client-Username + encoder. Add debian/patches/icap-username-encoding.patch. + * CVE-2026-62846: Reject illegal FTP command framing. Add + debian/patches/CVE-2026-62846-523ed3b0.patch. + + -- Aron Xu Fri, 30 Oct 2026 21:28:27 +0800 + squid (6.13-2+deb13u3) trixie; urgency=medium * CVE-2026-33515 diff -Nru squid-6.13/debian/patches/CVE-2026-104786.patch squid-6.13/debian/patches/CVE-2026-104786.patch --- squid-6.13/debian/patches/CVE-2026-104786.patch 1970-01-01 00:00:00.000000000 +0000 +++ squid-6.13/debian/patches/CVE-2026-104786.patch 2026-10-30 13:26:44.000000000 +0000 @@ -0,0 +1,121 @@ +Description: Protect fixed-size base64 encoding buffers + Check HTTP authentication and ICAP credential lengths before encoding, and + bound-check the URL, negotiate authentication and Windows SSPI buffers. + CVE-2026-104786 / SQUID-2026:7 concerns HTTP peer authentication; + SQUID-2026:8 concerns ICAP authentication and has no assigned CVE. + . + On Squid 6.13 the Windows SSPI file is lib/sspwin32.cc rather than + lib/sspi/sspwin32.cc. The negotiate authentication include is placed after + the Apple Kerberos macro block, inside the existing feature guard. +Author: Francesco Chemolli <5175948+kinkie@users.noreply.github.com> +Origin: upstream, https://github.com/squid-cache/squid/commit/8b3c2f2eea22886288edb47d4c30177bf8673650 +Bug: https://github.com/squid-cache/squid/security/advisories/GHSA-j9pf-q9f6-v44c +Bug: https://github.com/squid-cache/squid/security/advisories/GHSA-vh99-xw7j-fx5c +Forwarded: not-needed + +--- a/lib/sspwin32.cc ++++ b/lib/sspwin32.cc +@@ -492,6 +492,7 @@ + struct base64_encode_ctx ctx; + base64_encode_init(&ctx); + static char encoded[8192]; ++ assert(base64_encode_len(cbOut) < sizeof(encoded)); + size_t dstLen = base64_encode_update(&ctx, encoded, cbOut, reinterpret_cast(fResult)); + assert(dstLen < sizeof(encoded)); + dstLen += base64_encode_final(&ctx, encoded+dstLen); +--- a/src/adaptation/icap/ModXact.cc ++++ b/src/adaptation/icap/ModXact.cc +@@ -1406,12 +1406,18 @@ + String vh=virgin.header->header.getById(Http::HdrType::PROXY_AUTHORIZATION); + buf.appendf("Proxy-Authorization: " SQUIDSTRINGPH "\r\n", SQUIDSTRINGPRINT(vh)); + } else if (request->extacl_user.size() > 0 && request->extacl_passwd.size() > 0) { ++ const auto userLen = request->extacl_user.size(); ++ const auto passwdLen = request->extacl_passwd.size(); ++ // +1 for the ':' separator between user and passwd ++ const auto plainLen = userLen + 1 + passwdLen; ++ if (plainLen > MAX_LOGIN_SZ) ++ throw TextException("extacl credentials too long for Proxy-Authorization", Here()); ++ char base64buf[base64_encode_len(MAX_LOGIN_SZ)]; + struct base64_encode_ctx ctx; + base64_encode_init(&ctx); +- char base64buf[base64_encode_len(MAX_LOGIN_SZ)]; +- size_t resultLen = base64_encode_update(&ctx, base64buf, request->extacl_user.size(), reinterpret_cast(request->extacl_user.rawBuf())); ++ auto resultLen = base64_encode_update(&ctx, base64buf, userLen, reinterpret_cast(request->extacl_user.rawBuf())); + resultLen += base64_encode_update(&ctx, base64buf+resultLen, 1, reinterpret_cast(":")); +- resultLen += base64_encode_update(&ctx, base64buf+resultLen, request->extacl_passwd.size(), reinterpret_cast(request->extacl_passwd.rawBuf())); ++ resultLen += base64_encode_update(&ctx, base64buf+resultLen, passwdLen, reinterpret_cast(request->extacl_passwd.rawBuf())); + resultLen += base64_encode_final(&ctx, base64buf+resultLen); + buf.appendf("Proxy-Authorization: Basic %.*s\r\n", (int)resultLen, base64buf); + } +--- a/src/http.cc ++++ b/src/http.cc +@@ -1853,8 +1853,12 @@ + username = request->auth_user_request->username(); + #endif + +- blen = base64_encode_update(&ctx, loginbuf, strlen(username), reinterpret_cast(username)); +- blen += base64_encode_update(&ctx, loginbuf+blen, strlen(request->peer_login +1), reinterpret_cast(request->peer_login +1)); ++ const auto usernameLen = strlen(username); ++ const auto suffixLen = strlen(request->peer_login + 1); ++ if (usernameLen + suffixLen > MAX_LOGIN_SZ) ++ throw TextException("peer login credentials too long", Here()); ++ blen = base64_encode_update(&ctx, loginbuf, usernameLen, reinterpret_cast(username)); ++ blen += base64_encode_update(&ctx, loginbuf+blen, suffixLen, reinterpret_cast(request->peer_login +1)); + blen += base64_encode_final(&ctx, loginbuf+blen); + httpHeaderPutStrf(hdr_out, header, "Basic %.*s", (int)blen, loginbuf); + return; +@@ -1865,9 +1869,14 @@ + (strcmp(request->peer_login, "PASS") == 0 || + strcmp(request->peer_login, "PROXYPASS") == 0)) { + +- blen = base64_encode_update(&ctx, loginbuf, request->extacl_user.size(), reinterpret_cast(request->extacl_user.rawBuf())); ++ const auto userLen = request->extacl_user.size(); ++ const auto passwdLen = request->extacl_passwd.size(); ++ // +1 for the ':' separator between user and passwd ++ if (userLen + 1 + passwdLen > MAX_LOGIN_SZ) ++ throw TextException("extacl credentials too long for peer login", Here()); ++ blen = base64_encode_update(&ctx, loginbuf, userLen, reinterpret_cast(request->extacl_user.rawBuf())); + blen += base64_encode_update(&ctx, loginbuf+blen, 1, reinterpret_cast(":")); +- blen += base64_encode_update(&ctx, loginbuf+blen, request->extacl_passwd.size(), reinterpret_cast(request->extacl_passwd.rawBuf())); ++ blen += base64_encode_update(&ctx, loginbuf+blen, passwdLen, reinterpret_cast(request->extacl_passwd.rawBuf())); + blen += base64_encode_final(&ctx, loginbuf+blen); + httpHeaderPutStrf(hdr_out, header, "Basic %.*s", (int)blen, loginbuf); + return; +@@ -1897,7 +1906,10 @@ + } + #endif /* HAVE_KRB5 && HAVE_GSSAPI */ + +- blen = base64_encode_update(&ctx, loginbuf, strlen(request->peer_login), reinterpret_cast(request->peer_login)); ++ const auto loginLen = strlen(request->peer_login); ++ if (loginLen > MAX_LOGIN_SZ) ++ throw TextException("peer_login too long", Here()); ++ blen = base64_encode_update(&ctx, loginbuf, loginLen, reinterpret_cast(request->peer_login)); + blen += base64_encode_final(&ctx, loginbuf+blen); + httpHeaderPutStrf(hdr_out, header, "Basic %.*s", (int)blen, loginbuf); + return; +@@ -2023,6 +2035,7 @@ + /* append Authorization if known in URL, not in header and going direct */ + if (!hdr_out->has(Http::HdrType::AUTHORIZATION)) { + if (flags.toOrigin && !request->url.userInfo().isEmpty()) { ++ Assure(request->url.userInfo().length() < MAX_URL*2); + static char result[base64_encode_len(MAX_URL*2)]; // should be big enough for a single URI segment + struct base64_encode_ctx ctx; + base64_encode_init(&ctx); +--- a/src/peer_proxy_negotiate_auth.cc ++++ b/src/peer_proxy_negotiate_auth.cc +@@ -17,6 +17,7 @@ + #define GSSKRB_APPLE_DEPRECATED(x) + #endif + ++#include "base/Assure.h" + #include "base64.h" + #include "compat/krb5.h" + #include "debug/Stream.h" +@@ -549,6 +550,7 @@ + static char b64buf[8192]; // XXX: 8KB only because base64_encode_bin() used to. + struct base64_encode_ctx ctx; + base64_encode_init(&ctx); ++ Assure(base64_encode_len(output_token.length) < sizeof(b64buf)); + size_t blen = base64_encode_update(&ctx, b64buf, output_token.length, reinterpret_cast(output_token.value)); + blen += base64_encode_final(&ctx, b64buf+blen); + b64buf[blen] = '\0'; diff -Nru squid-6.13/debian/patches/CVE-2026-61642.patch squid-6.13/debian/patches/CVE-2026-61642.patch --- squid-6.13/debian/patches/CVE-2026-61642.patch 1970-01-01 00:00:00.000000000 +0000 +++ squid-6.13/debian/patches/CVE-2026-61642.patch 2026-10-30 13:28:27.000000000 +0000 @@ -0,0 +1,46 @@ +From d06f48de8b8cc9a378cb91ecfe8e89b6e81696d2 Mon Sep 17 00:00:00 2001 +From: Amos Jeffries +Date: Sun, 31 May 2026 08:29:04 +0000 +Subject: [PATCH] HTTP/1.1: Transfer-Encoding:identity is prohibited (#2427) + +HTTP specification deprecated identity encoding but still allows +its use as an unknown encoding when the Transfer-Encoding +header is otherwise correctly used. + +Squid compliance update at the time kept accepting identity +encoding as it was being used by agents. The form supported was +Transfer-Encoding:identity. + +However, the HTTP specification explicitly requires that any +encoding MUST be wrapped within chunked encoding. + +As such the bare Transfer-Encoding:identity form Squid accepted +is explicitly prohibited. + +The correct Transfer-Encoding:identity,chunked syntax has been +rejected by Squid for nearly 5 years already without complaint. +So support is being dropped entirely here. +Origin: upstream, https://github.com/squid-cache/squid/commit/d06f48de8b8cc9a378cb91ecfe8e89b6e81696d2 +Bug: https://github.com/squid-cache/squid/security/advisories/GHSA-537g-4gfh-w7m6 +Forwarded: not-needed + +--- + src/HttpHeader.cc | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/src/HttpHeader.cc b/src/HttpHeader.cc +index 3e06deab6..39422123f 100644 +--- a/src/HttpHeader.cc ++++ b/src/HttpHeader.cc +@@ -509,8 +509,6 @@ HttpHeader::parse(const char *header_start, size_t hdrLen, Http::ContentLengthIn + + if (rawTe.caseCmp("chunked") == 0) { + ; // leave header present for chunked() method +- } else if (rawTe.caseCmp("identity") == 0) { // deprecated. no coding +- delById(Http::HdrType::TRANSFER_ENCODING); + } else { + // This also rejects multiple encodings until we support them properly. + debugs(55, warnOnError, "WARNING: unsupported Transfer-Encoding used by client: " << rawTe); +-- +2.47.3 + diff -Nru squid-6.13/debian/patches/CVE-2026-62846-523ed3b0.patch squid-6.13/debian/patches/CVE-2026-62846-523ed3b0.patch --- squid-6.13/debian/patches/CVE-2026-62846-523ed3b0.patch 1970-01-01 00:00:00.000000000 +0000 +++ squid-6.13/debian/patches/CVE-2026-62846-523ed3b0.patch 2026-10-30 13:26:44.000000000 +0000 @@ -0,0 +1,30 @@ +Description: Do not send FTP commands with embedded CRs or LFs +Author: Ricardo Ferreira Ribeiro +Origin: backport, https://github.com/squid-cache/squid/commit/523ed3b037cd61b9e3222a6c5d937728fb21aeee +Bug: https://github.com/squid-cache/squid/security/advisories/GHSA-9vhr-vcrv-x837 +Forwarded: not-needed + +--- a/src/clients/FtpClient.cc ++++ b/src/clients/FtpClient.cc +@@ -843,6 +843,21 @@ + void + Ftp::Client::writeCommand(const char *buf) + { ++ // The caller must supply a non-empty command followed by CRLF. ++ // TODO: Move CRLF appending code from callers to here. ++ const auto bufLen = strlen(buf); ++ Assure(bufLen > 2); ++ Assure(buf[bufLen-2] == '\r'); ++ Assure(buf[bufLen-1] == '\n'); ++ ++ const auto crlfCharPosition = strcspn(buf, crlf); ++ if (crlfCharPosition != bufLen-2) { ++ const auto invalidCharName = buf[crlfCharPosition] == '\r' ? "CR" : "LF"; ++ debugs(9, 2, "ERROR: Caller assembled a malformed FTP command. Found " << invalidCharName << " at position " << crlfCharPosition); ++ failed(ERR_FTP_FAILURE, 0); ++ return; ++ } ++ + char *ebuf; + /* trace FTP protocol communications at level 2 */ + debugs(9, 2, "ftp<< " << buf); diff -Nru squid-6.13/debian/patches/icap-username-encoding.patch squid-6.13/debian/patches/icap-username-encoding.patch --- squid-6.13/debian/patches/icap-username-encoding.patch 1970-01-01 00:00:00.000000000 +0000 +++ squid-6.13/debian/patches/icap-username-encoding.patch 2026-10-30 13:26:44.000000000 +0000 @@ -0,0 +1,23 @@ +Description: Protect ICAP client username base64 encoding buffer + Check the username length before encoding an X-Client-Username header into + the fixed-size buffer. This protects a separate encoder from the preceding + base64 buffer hardening patch and has no independently assigned CVE. +Author: Francesco Chemolli <5175948+kinkie@users.noreply.github.com> +Origin: upstream, https://github.com/squid-cache/squid/commit/901a01e14ca8257a0232d9cd7c1b99f32c28b720 +Forwarded: not-needed + +--- a/src/adaptation/icap/ModXact.cc ++++ b/src/adaptation/icap/ModXact.cc +@@ -1573,8 +1573,11 @@ + + if (value) { + if (TheConfig.client_username_encode) { ++ const auto valueLen = strlen(value); ++ if (valueLen > MAX_LOGIN_SZ) ++ throw TextException("username too long for X-Client-Username header", Here()); + char base64buf[base64_encode_len(MAX_LOGIN_SZ)]; +- size_t resultLen = base64_encode_update(&ctx, base64buf, strlen(value), reinterpret_cast(value)); ++ size_t resultLen = base64_encode_update(&ctx, base64buf, valueLen, reinterpret_cast(value)); + resultLen += base64_encode_final(&ctx, base64buf+resultLen); + buf.appendf("%s: %.*s\r\n", TheConfig.client_username_header, (int)resultLen, base64buf); + } else diff -Nru squid-6.13/debian/patches/series squid-6.13/debian/patches/series --- squid-6.13/debian/patches/series 2026-09-03 20:51:24.000000000 +0000 +++ squid-6.13/debian/patches/series 2026-10-30 13:28:27.000000000 +0000 @@ -9,3 +9,7 @@ CVE-2026-47729.patch CVE-2026-50012.patch CVE-2026-32748.patch +CVE-2026-61642.patch +CVE-2026-104786.patch +icap-username-encoding.patch +CVE-2026-62846-523ed3b0.patch