Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:squid
User: [email protected]
Usertags: pu
Fixes a low severity security issue. All tests were fine in Debusine
and also confirmed on a Trixie cache based on Squid. Debdiff below.
Cheers,
Moritz
diff -Nru squid-6.13/debian/changelog squid-6.13/debian/changelog
--- squid-6.13/debian/changelog 2026-06-19 17:54:19.000000000 +0200
+++ squid-6.13/debian/changelog 2026-09-03 22:51:56.000000000 +0200
@@ -1,3 +1,9 @@
+squid (6.13-2+deb13u3) trixie; urgency=medium
+
+ * CVE-2026-33515
+
+ -- Moritz Mühlenhoff <[email protected]> Thu, 03 Sep 2026 22:51:56 +0200
+
squid (6.13-2+deb13u2) trixie-security; urgency=medium
* CVE-2026-33515
diff -Nru squid-6.13/debian/patches/CVE-2026-32748.patch
squid-6.13/debian/patches/CVE-2026-32748.patch
--- squid-6.13/debian/patches/CVE-2026-32748.patch 1970-01-01
01:00:00.000000000 +0100
+++ squid-6.13/debian/patches/CVE-2026-32748.patch 2026-09-03
22:51:39.000000000 +0200
@@ -0,0 +1,146 @@
+From 703e07d25ca6fa11f52d20bf0bb879e22ab7481b Mon Sep 17 00:00:00 2001
+From: Alex Rousskov <[email protected]>
+Date: Wed, 18 Feb 2026 21:13:26 +0000
+Subject: [PATCH] ICP: Fix HttpRequest lifetime for ICP v3 queries (#2377)
+
+--- squid-6.13.orig/src/ICP.h
++++ squid-6.13/src/ICP.h
+@@ -94,10 +94,7 @@ extern Ip::Address theIcpPublicHostID;
+ const char *icpGetUrl(const Ip::Address &from, const char *, const
icp_common_t &);
+
+ /// \ingroup ServerProtocolICPAPI
+-HttpRequest *icpGetRequest(const char *url, int reqnum, int fd, const
Ip::Address &from);
+-
+-/// \ingroup ServerProtocolICPAPI
+-bool icpAccessAllowed(Ip::Address &from, HttpRequest * icp_request);
++HttpRequestPointer icpGetRequest(const char *url, int reqnum, int fd, const
Ip::Address &from);
+
+ /// \ingroup ServerProtocolICPAPI
+ void icpCreateAndSend(icp_opcode, int flags, char const *url, int reqnum, int
pad, int fd, const Ip::Address &from, AccessLogEntryPointer);
+--- squid-6.13.orig/src/icp_v2.cc
++++ squid-6.13/src/icp_v2.cc
+@@ -440,8 +440,9 @@ icpDenyAccess(const Ip::Address &from, c
+ }
+ }
+
+-bool
+-icpAccessAllowed(Ip::Address &from, HttpRequest * icp_request)
++/// icpGetRequest() helper that determines whether squid.conf allows the
given ICP query
++static bool
++icpAccessAllowed(const Ip::Address &from, HttpRequest * icp_request)
+ {
+ /* absent any explicit rules, we deny all */
+ if (!Config.accessList.icp)
+@@ -486,7 +487,7 @@ icpGetUrl(const Ip::Address &from, const
+ return url;
+ }
+
+-HttpRequest *
++HttpRequest::Pointer
+ icpGetRequest(const char * const url, const int reqnum, const int fd, const
Ip::Address &from)
+ {
+ if (strpbrk(url, w_space)) {
+@@ -495,12 +496,17 @@ icpGetRequest(const char * const url, co
+ }
+
+ const auto mx = MasterXaction::MakePortless<XactionInitiator::initIcp>();
+- auto *result = HttpRequest::FromUrlXXX(url, mx);
+- if (!result)
+- icpCreateAndSend(ICP_ERR, 0, url, reqnum, 0, fd, from, nullptr);
++ if (const HttpRequest::Pointer request = HttpRequest::FromUrlXXX(url,
mx)) {
++ if (!icpAccessAllowed(from, request.getRaw())) {
++ icpDenyAccess(from, url, reqnum, fd);
++ return nullptr;
++ }
+
+- return result;
++ return request;
++ }
+
++ icpCreateAndSend(ICP_ERR, 0, url, reqnum, 0, fd, from, nullptr);
++ return nullptr;
+ }
+
+ static void
+@@ -516,18 +522,11 @@ doV2Query(const int fd, Ip::Address &fro
+ return;
+ }
+
+- HttpRequest *icp_request = icpGetRequest(url, header.reqnum, fd, from);
++ const auto icp_request = icpGetRequest(url, header.reqnum, fd, from);
+
+ if (!icp_request)
+ return;
+
+- HTTPMSGLOCK(icp_request);
+-
+- if (!icpAccessAllowed(from, icp_request)) {
+- icpDenyAccess(from, url, header.reqnum, fd);
+- HTTPMSGUNLOCK(icp_request);
+- return;
+- }
+ #if USE_ICMP
+ if (header.flags & ICP_FLAG_SRC_RTT) {
+ rtt = netdbHostRtt(icp_request->url.host());
+@@ -540,7 +539,7 @@ doV2Query(const int fd, Ip::Address &fro
+ #endif /* USE_ICMP */
+
+ /* The peer is allowed to use this cache */
+- ICP2State state(header, icp_request);
++ ICP2State state(header, icp_request.getRaw());
+ state.fd = fd;
+ state.from = from;
+ state.url = xstrdup(url);
+@@ -569,8 +568,6 @@ doV2Query(const int fd, Ip::Address &fro
+ }
+
+ icpCreateAndSend(codeToSend, flags, url, header.reqnum, src_rtt, fd,
from, state.al);
+-
+- HTTPMSGUNLOCK(icp_request);
+ }
+
+ void
+--- squid-6.13.orig/src/icp_v3.cc
++++ squid-6.13/src/icp_v3.cc
+@@ -40,19 +40,13 @@ doV3Query(int fd, Ip::Address &from, con
+ return;
+ }
+
+- HttpRequest *icp_request = icpGetRequest(url, header.reqnum, fd, from);
++ const auto icp_request = icpGetRequest(url, header.reqnum, fd, from);
+
+ if (!icp_request)
+ return;
+
+- if (!icpAccessAllowed(from, icp_request)) {
+- icpDenyAccess (from, url, header.reqnum, fd);
+- delete icp_request;
+- return;
+- }
+-
+ /* The peer is allowed to use this cache */
+- ICP3State state(header, icp_request);
++ ICP3State state(header, icp_request.getRaw());
+ state.fd = fd;
+ state.from = from;
+ state.url = xstrdup(url);
+--- squid-6.13.orig/src/tests/stub_icp.cc
++++ squid-6.13/src/tests/stub_icp.cc
+@@ -9,6 +9,7 @@
+ #include "squid.h"
+ #include "AccessLogEntry.h"
+ #include "comm/Connection.h"
++#include "HttpRequest.h"
+ #include "ICP.h"
+
+ #define STUB_API "icp_*.cc"
+@@ -30,8 +31,7 @@ Comm::ConnectionPointer icpOutgoingConn;
+ Ip::Address theIcpPublicHostID;
+
+ const char *icpGetUrl(const Ip::Address &, const char *, const icp_common_t
&) STUB_RETVAL(nullptr)
+-HttpRequest* icpGetRequest(const char *, int, int, const Ip::Address &)
STUB_RETVAL(nullptr)
+-bool icpAccessAllowed(Ip::Address &, HttpRequest *) STUB_RETVAL(false)
++HttpRequest::Pointer icpGetRequest(const char *, int, int, const Ip::Address
&) STUB_RETVAL(nullptr)
+ void icpCreateAndSend(icp_opcode, int, char const *, int, int, int, const
Ip::Address &, AccessLogEntryPointer) STUB
+ icp_opcode icpGetCommonOpcode() STUB_RETVAL(ICP_INVALID)
+ void icpDenyAccess(const Ip::Address &, const char *, int, int) STUB
diff -Nru squid-6.13/debian/patches/series squid-6.13/debian/patches/series
--- squid-6.13/debian/patches/series 2026-06-19 16:06:29.000000000 +0200
+++ squid-6.13/debian/patches/series 2026-09-03 22:51:24.000000000 +0200
@@ -8,3 +8,4 @@
CVE-2026-33526.patch
CVE-2026-47729.patch
CVE-2026-50012.patch
+CVE-2026-32748.patch
