[squid-users] [squid-announce] [ADVISORY] SQUID-2026:9 FTP command injection in FTP gateway

[Matus UHLAR - fantomas]

Hello,

On 12.09.26 14:55, Amos Jeffries wrote:
> Advisory ID:       | SQUID-2026:9
> Date:              | 2026-07-05
> Summary:           | FTP command injection in FTP gateway
> Affected versions: | Squid 2.x -> 2.7.STABLE9
>                    | Squid 3.x -> 3.5.28
>                    | Squid 4.x -> 4.17
>                    | Squid 5.x -> 5.9
>                    | Squid 6.x -> 6.14
>                    | Squid 7.x -> 7.6
> Fixed in version:  | Squid 7.7

On 12.09.26 15:13, Amos Jeffries wrote:
> Advisory ID:       | SQUID-2026:6
> Date:              | 2026-06-23
> Summary:           | Request Smuggling in HTTP Transfer-Encoding
> Affected versions: | Squid 3.3 -> 3.5.28
>                    | Squid 4.x -> 4.17
>                    | Squid 5.x -> 5.9
>                    | Squid 6.x -> 6.14
>                    | Squid 7.x -> 7.5
> Fixed in version:  | Squid 7.6


Has anyone tried to backport these fixes to 6 (possibly 6.13 in debian)?

-- 
Matus UHLAR - fantomas, uhlar at fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Linux is like a teepee: no Windows, no Gates and an apache inside...