CVE-2019-18679

An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.

• CWE-200

• http://www.squid-cache.org/Advisories/SQUID-2019_11.txtThird Party Advisory
• http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156dc4c717ee52ad22fba0f7443.patchRelease Notes
• https://bugzilla.suse.com/show_bug.cgi?id=1156324Issue Tracking, Third Party Advisory
• https://github.com/squid-cache/squid/pull/491Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/12/msg00011.htmlThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/
• https://security.gentoo.org/glsa/202003-34
• https://usn.ubuntu.com/4213-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4682
• http://www.squid-cache.org/Advisories/SQUID-2019_11.txtThird Party Advisory
• http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156dc4c717ee52ad22fba0f7443.patchRelease Notes
• https://bugzilla.suse.com/show_bug.cgi?id=1156324Issue Tracking, Third Party Advisory
• https://github.com/squid-cache/squid/pull/491Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/12/msg00011.htmlThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/
• https://security.gentoo.org/glsa/202003-34
• https://usn.ubuntu.com/4213-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4682

Published

Nov 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18673On SHIFT BitBox02 devices, a side channel for the row-based …4.6
• CVE-2019-18674An issue was discovered in Joomla! before 3.9.13. A missing …5.3
• CVE-2019-18675The Linux kernel through 5.3.13 has a start_offset+size Inte…7.8
• CVE-2019-18676An issue was discovered in Squid 3.x and 4.x through 4.8. Du…7.5
• CVE-2019-18677An issue was discovered in Squid 3.x and 4.x through 4.8 whe…6.1
• CVE-2019-18678An issue was discovered in Squid 3.x and 4.x through 4.8. It…5.3
• CVE-2019-1868A vulnerability in the web-based management interface of Cis…7.5
• CVE-2019-18680An issue was discovered in the Linux kernel 4.4.x before 4.4…7.5
• CVE-2019-18683An issue was discovered in drivers/media/platform/vivid in t…7
• CVE-2019-18684Sudo through 1.8.29 allows local users to escalate to root i…7
• CVE-2019-18685Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-18686Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…