linux/meta-openembedded.git/meta-networking/recipes-daemons/squid, branch kirkstone

squid: upgrade 4.15 -> 4.17

2026-01-20T17:22:02+00:00

These are bugfix releases. Changelogs: 4.17: - WCCP: Validate packets better 4.16: - Regression Fix: --with-valgrind-debug build broken since 4.15 - Bug 5129 pt1: remove Lock use from HttpRequestMethod - Bug 5128: Translation: Fix '% i' typo in es/ERR_FORWARDING_DENIED - Bug 4528: ICAP transactions quit on async DNS lookups Signed-off-by: Gyorgy Sarvari

squid: fix esi PACKAGECONFIG

2025-10-27T10:17:33+00:00

libxml has derecated the "xmlSetFeature" call, and hid is behind a special config flag (--with-legacy), which is not used by default in oe-core. This makes compilation fail, when "esi" PACKAGECONFIG is enabled: Libxml2Parser.cc:94:5: error: 'xmlSetFeature' was not declared in this scope; did you mean 'xmlHasFeature'? This backported patch fixes this. Signed-off-by: Gyorgy Sarvari

squid: patch CVE-2025-59362

2025-10-27T10:17:30+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-59362 Pick the PR content that's referenced in the nvd report. Signed-off-by: Gyorgy Sarvari

squid: patch CVE-2023-46724

2025-10-27T10:17:28+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2023-46724 Pick the patch from the details of the nvd report. Signed-off-by: Gyorgy Sarvari

squid: patch CVE-2022-41318

2025-10-27T10:17:25+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2022-41318 Pick the v4 patch referenced in the nvd report. Signed-off-by: Gyorgy Sarvari

squid: patch CVE-2022-41317

2025-10-27T10:17:22+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2022-41317 Pick the v4 patch referenced in the nvd report. Signed-off-by: Gyorgy Sarvari

squid: patch CVE-2021-46784

2025-10-27T10:17:18+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2021-46784 Pick the backported patch from v4 branch, that referenced the same PR[1] that the patch[2] from the nvd report refers to. [1]: https://github.com/squid-cache/squid/pull/1022 [2]: https://github.com/squid-cache/squid/commit/5e2ea2b13bd98f53e29964ca26bb0d602a8a12b9 Signed-off-by: Gyorgy Sarvari

squid: mark CVE-2025-54574 as patched

2025-10-17T08:51:27+00:00

Per [1] CVE-2025-54574 is fixed in patch for CVE-2023-5824. That was a composite patch from more commits. When checking it, it really contains also commit [2] which is mentioned as fix for CVE-2025-54574. [1] https://security-tracker.debian.org/tracker/CVE-2025-54574 [2] https://github.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988 Signed-off-by: Peter Marko Signed-off-by: Gyorgy Sarvari

squid: conditionally set status of CVE-2024-45802

2024-12-08T19:38:16+00:00

According to [1] the ESI feature implementation in squid is vulnerable without any fix available. NVD says it's fixed in 6.10, however the change in this release only disables ESI by default (which we always did via PACKAGECONFIG). Commit in master branch related to this CVE is [2]. Title is "Remove Edge Side Include (ESI) protocol" and it's also what it does. So there will never be a fix for these ESI vulnerabilities. We should not break features in LTS branch and cannot fix this problem. So ignrore this CVE based on set PACKAGECONFIG which should remove it from reports for most users. Thos who need ESI need to assess the risk themselves. [1] https://github.com/squid-cache/squid/security/advisories/GHSA-f975-v7qw-q7hj [2] https://github.com/squid-cache/squid/commit/5eb89ef3d828caa5fc43cd8064f958010dbc8158 Signed-off-by: Peter Marko Signed-off-by: Armin Kuster

squid: Security fix CVE-2023-5824

2024-09-22T14:12:40+00:00

References: https://access.redhat.com/security/cve/cve-2023-5824 https://access.redhat.com/errata/RHSA-2023:7668 The patch is from RHEL8. Signed-off-by: Vijay Anusuri Signed-off-by: Armin Kuster