Subject: CVS commit: pkgsrc/www/squid4
From: Takahiro Kambe
Date: 2021-05-10 16:22:57
Message id: 20210510142257.1144CFA96@cvs.NetBSD.org

Log Message:
www/squid4: update to 4.15

This release fixes these security issues from prior release.

* SQUID-2020:11 HTTP Request Smuggling
  (CVE-2020-25097)
* SQUID-2021:1 Denial of Service in URN processing
  (CVE-2021-28651)
* SQUID-2021:2 Denial of Service in HTTP Response Processing
  (CVE-2021-28662)
* SQUID-2021:3 Denial of Service issue in Cache Manager
  (CVE-2021-28652)
* SQUID-2021:4 Multiple issues in HTTP Range header
  (CVE-2021-31806, CVE-2021-31807, CVE-2021-31808)
* SQUID-2021:5 Denial of Service in HTTP Response Processing
  (CVE pending allocation)

Changes in squid-4.15 (10 May 2021):

	- Bug 5112: Excessively loud chunked reply parsing error reporting
	- Bug 5106: Broken cache manager URL parsing
	- Bug 5104: Memory leak in RFC 2169 response parsing
	- Bug 3556: "FD ... is not an open socket" for accept() problems
	- Profiling: CPU timing implemented for MAC non-x86
	- Fix HttpHeaderStats definition to include hoErrorDetail
	- Fix Squid-to-client write_timeout triggers client_lifetime timeout
	- Limit HeaderLookupTable_t::lookup() to BadHdr and specific IDs
	- Handle more Range requests
	- Handle more partial responses
	- Stop processing a response if the Store entry is gone
	- ... and some portability fixes
	- ... and some documentation updates

Files:
RevisionActionfile
1.18modifypkgsrc/www/squid4/Makefile
1.11modifypkgsrc/www/squid4/distinfo