russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.5 KiB

Raw Blame History

Squid — CWE-312 Disclosure Brief (squid-0003)

2026-04-13 · Patch available — awaiting upstream merge

Finding

Multiple cleartext credential logging defects in Squid's FTP gateway and Basic auth subsystems. FTP login credentials (username and password) log verbatim via debugs() at various debug levels. Basic auth credentials (base64-encoded header and decoded cleartext) also log verbatim.

The Defects

squid-0003a (PATCHED — HIGH): src/clients/FtpGateway.cc:399 — FTP credentials

debugs(9, 9, "IN : login=" << login << ", user=" << user << ", password=" << password);
debugs(9, 9, "found password=" << pass);
debugs(9, 9, "found password=" << password << " (" << strlen(password) << ") unescaped.");
debugs(9, 9, "OUT: login=" << login << ", user=" << user << ", password=" << password);

squid-0003b (PATCHED — HIGH): src/auth/basic/Config.cc:184 — Basic auth credentials

debugs(29, 9, "'" << cleartext << "'");  // decoded username:password
debugs(29, DBG_IMPORTANT, "WARNING: Bad characters in authorization header '" << httpAuthHeader << "'");

squid-0003c (PATCHED — HIGH): src/auth/basic/UserRequest.cc:102 — Basic auth lookup

debugs(29, 9, "'" << basic_auth->username() << ":" << basic_auth->passwd << "'");

Impact

Squid proxies handle authentication for organizations worldwide. When debug logging activates (common during troubleshooting), FTP usernames/passwords and Basic auth credentials appear in plaintext in cache.log. These logs persist on disk and may replicate to centralized logging systems.

The Fix

Replace credential values with redacted placeholders or length-only summaries:

debugs(9, 9, "IN : login=[REDACTED], escaped=" << escaped);
debugs(9, 9, "found password (length=" << pass.length() << ")");
debugs(29, 9, "decoded basic credentials (length " << strlen(cleartext) << ")");
debugs(29, 9, "looking up basic auth user '" << basic_auth->username() << "' (password suppressed)");

Patch

Fix available: defects/squid-0003/patch/squid-0003.patch

Multi-file patch: FtpGateway.cc, Config.cc, UserRequest.cc.

What We Ask

Confirm receipt and assign a Bugzilla reference (bugs.squid-cache.org).
Assess severity — FTP and Basic auth credentials log in plaintext.
Coordinate a disclosure date — targeting 90 days from first contact.
We will credit the Squid team in the public disclosure.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.5 KiB Raw Blame History