Thomas Perale
8918f1c2c8
Fixes the following vulnerability:
- CVE-2025-62168:
Squid is a caching proxy for the Web. In Squid versions prior to 7.2,
a failure to redact HTTP authentication credentials in error handling
allows information disclosure. The vulnerability allows a script to
bypass browser security protections and learn the credentials a
trusted client uses to authenticate. This potentially allows a remote
client to identify security tokens or credentials used internally by a
web application using Squid for backend load balancing. These attacks
do not require Squid to be configured with HTTP authentication. The
vulnerability is fixed in version 7.2. As a workaround, disable debug
information in administrator mailto links generated by Squid by
configuring squid.conf with email_err_data off.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-62168
- https://github.com/squid-cache/squid/commit/0951a0681011dfca3d78c84fd7f1e19c78a4443f
The backport has been compared against debian patch [1].
[1] https://sources.debian.org/src/squid/6.13-2%2Bdeb13u1/debian/patches/CVE-2025-62168.patch
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
111 lines
2.9 KiB
Makefile
111 lines
2.9 KiB
Makefile
################################################################################
|
|
#
|
|
# squid
|
|
#
|
|
################################################################################
|
|
|
|
SQUID_VERSION = 6.14
|
|
SQUID_SOURCE = squid-$(SQUID_VERSION).tar.xz
|
|
SQUID_SITE = https://github.com/squid-cache/squid/releases/download/SQUID_$(subst .,_,$(SQUID_VERSION))
|
|
SQUID_LICENSE = GPL-2.0+
|
|
SQUID_LICENSE_FILES = COPYING
|
|
SQUID_CPE_ID_VENDOR = squid-cache
|
|
SQUID_SELINUX_MODULES = apache squid
|
|
|
|
# 0001-Fix-ASN-1-encoding-of-long-SNMP-OIDs.patch
|
|
SQUID_IGNORE_CVES += CVE-2025-59362
|
|
|
|
# 0002-Proxy-auth-data-visible-to-scripts.patch
|
|
SQUID_IGNORE_CVES += CVE-2025-62168
|
|
|
|
SQUID_DEPENDENCIES = libcap host-libcap libtool libxml2 host-pkgconf \
|
|
$(if $(BR2_PACKAGE_LIBNETFILTER_CONNTRACK),libnetfilter_conntrack)
|
|
SQUID_CONF_ENV = \
|
|
ac_cv_epoll_works=yes \
|
|
ac_cv_func_setresuid=yes \
|
|
ac_cv_func_va_copy=yes \
|
|
ac_cv_func___va_copy=yes \
|
|
ac_cv_func_strnstr=no \
|
|
ac_cv_have_squid=yes \
|
|
BUILDCXX="$(HOSTCXX)" \
|
|
BUILDCXXFLAGS="$(HOST_CXXFLAGS) -std=c++17"
|
|
SQUID_CONF_OPTS = \
|
|
--enable-async-io=8 \
|
|
--enable-linux-netfilter \
|
|
--enable-removal-policies="lru,heap" \
|
|
--with-filedescriptors=1024 \
|
|
--disable-ident-lookups \
|
|
--enable-auth-basic="fake getpwnam" \
|
|
--enable-auth-digest="file" \
|
|
--enable-auth-negotiate="wrapper" \
|
|
--enable-auth-ntlm="fake" \
|
|
--disable-strict-error-checking \
|
|
--enable-external-acl-helpers="file_userip" \
|
|
--disable-ltdl-install \
|
|
--without-included-ltdl \
|
|
--with-logdir=/var/log/squid/ \
|
|
--with-pidfile=/var/run/squid.pid \
|
|
--with-swapdir=/var/cache/squid/ \
|
|
--with-default-user=squid
|
|
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
|
|
SQUID_CONF_ENV += LIBS=-latomic
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBKRB5),y)
|
|
SQUID_CONF_OPTS += --with-mit-krb5
|
|
SQUID_DEPENDENCIES += libkrb5
|
|
else
|
|
SQUID_CONF_OPTS += --without-mit-krb5
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBXCRYPT),y)
|
|
SQUID_DEPENDENCIES += libxcrypt
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_OPENSSL),y)
|
|
SQUID_CONF_OPTS += --with-openssl
|
|
SQUID_DEPENDENCIES += openssl
|
|
else
|
|
SQUID_CONF_OPTS += --without-openssl
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_GNUTLS),y)
|
|
SQUID_CONF_OPTS += --with-gnutls
|
|
SQUID_DEPENDENCIES += gnutls
|
|
else
|
|
SQUID_CONF_OPTS += --without-gnutls
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_SYSTEMD),y)
|
|
SQUID_CONF_OPTS += --with-systemd
|
|
SQUID_DEPENDENCIES += systemd
|
|
else
|
|
SQUID_CONF_OPTS += --without-systemd
|
|
endif
|
|
|
|
define SQUID_CLEANUP_TARGET
|
|
rm -f $(addprefix $(TARGET_DIR)/usr/bin/, \
|
|
RunCache RunAccel)
|
|
rm -f $(addprefix $(TARGET_DIR)/etc/, \
|
|
cachemgr.conf mime.conf.default squid.conf.default)
|
|
endef
|
|
|
|
SQUID_POST_INSTALL_TARGET_HOOKS += SQUID_CLEANUP_TARGET
|
|
|
|
define SQUID_USERS
|
|
squid -1 squid -1 * - - - Squid proxy cache
|
|
endef
|
|
|
|
define SQUID_INSTALL_INIT_SYSV
|
|
$(INSTALL) -m 755 -D package/squid/S97squid \
|
|
$(TARGET_DIR)/etc/init.d/S97squid
|
|
endef
|
|
|
|
define SQUID_INSTALL_INIT_SYSTEMD
|
|
$(INSTALL) -D -m 0644 $(@D)/tools/systemd/squid.service \
|
|
$(TARGET_DIR)/usr/lib/systemd/system/squid.service
|
|
endef
|
|
|
|
$(eval $(autotools-package))
|