# changelog

author: adam.majer@suse.de
changelog:
  - Change pinger and basic_pam_auth helper to use standard permissions.
    pinger uses cap_net_raw=ep instead (bsc#1171569)
  - Move squid helpers under /usr/lib{,64}/squid for Tumbleweed and SLE16
    Please adjust your config paths accordingly


author: adam.majer@suse.de
changelog:
  - squid 4.13:
    * Enforce token characters for field-name (#700)
    * Fix livelocking in peerDigestHandleReply (#698)
      (bsc#1175671, CVE-2020-24606)
    * Improve Transfer-Encoding handling (#702)
      (bsc#1175665, CVE-2020-15811)
    * Forbid obs-fold and bare CR whitespace in framing header fields (#701)
    * Source Format Enforcement
    * Enforce token characters for field-name (#700)
      (bsc#1175664, CVE-2020-15810)
    * Do not stall while debugging a scan of an empty store_table (#699)
    * Fix livelocking in peerDigestHandleReply (#698)
    * Honor on_unsupported_protocol for intercepted https_port (#689)
    * Bug #5051: Some collapsed revalidation responses never expire (#683)
    * SslBump: Support parsing GREASEd (and future) TLS handshakes (#663)


author: matthias.gerstner@suse.com
changelog:
  - Reinstate permissions macros for pinger binary, because the permissions
    package is also responsible for setting up the cap_net_raw capability,
    currently a fresh squid install doesn't get a capability bit at all
    (bsc#1171569).


author: matthias.gerstner@suse.com
changelog:
  - fix previous change to reinstante permissions macros, because the wrong path
    has been used (bsc#1171569).
  - use libexecdir instead of libdir to conform to recent changes in Factory
    (bsc#1171164).


author: dmueller@suse.com
changelog:
  - update to 4.14:
    - fixes HTTP Request Smuggling vulnerability (bsc#1183436, CVE-2020-25097)
    - Regression Fix: support for non-lowercase Transfer-Encoding value
    - Regression Fix: cachemgr.cgi wrong 403 response to authenticated menu URIs
    - Bug 5076: WCCP Security Info incorrect
    - Bug 5073: Compile error: index was not declared in this scope
    - Bug 5065: url_rewrite_program documentation update
    - Bug 3074 pt2: improved handling of URI paths implicit '/'
    - Fix transactions exceeding client_lifetime logged as _ABORTED


author: dmueller@suse.com
changelog:
  - update to 4.15:
    - Bug 5112: Excessively loud chunked reply parsing error reporting
    - Bug 5106: Broken cache manager URL parsing (bsc#1185918, CVE-2021-28652)
    - Bug 5104: Memory leak in RFC 2169 response parsing
      (bsc#1185921, CVE-2021-28651)
    - Bug 3556: "FD ... is not an open socket" for accept() problems
    - Profiling: CPU timing implemented for MAC non-x86
    - Fix HttpHeaderStats definition to include hoErrorDetail
    - Fix Squid-to-client write_timeout triggers client_lifetime timeout
    - Limit HeaderLookupTable_t::lookup() to BadHdr and specific IDs
      (bsc#1185919, CVE-2021-28662)
    - Handle more Range requests (bsc#1185916, CVE-2021-31806)
    - Handle more partial responses (bsc#1185923, bnc#1186654, CVE-2021-33620)
    - Stop processing a response if the Store entry is gone
    - ... and some portability fixes
    - ... and some documentation updates


author: adam.majer@suse.de
changelog:
  - update to 4.17:
    * WCCP: Validate packets better (#899). Fixes a out-of-bounds
      access in WCCP protocol data that may lead to information disclosure
      (bsc#1189403, CVE-2021-28116)
  - changes in 4.16:
    * Bug 4528: ICAP transactions quit on async DNS lookups (#795)
    * Bug 5128: Translation: Fix % i typo in es/ERR_FORWARDING_DENIED (#821)
    * Bug 5129 pt1: remove Lock use from HttpRequestMethod (#825)


