<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi,<div class=""><br class=""></div><div class="">The link you provided refers to an issue with proxy certificates for SSL interception. This feature is disabled in Debian squid3 package due to licensing issues with OpenSSL, thus this is not a bug in Debian squid3 packages.</div><div class=""><br class=""></div><div class="">The only way this bug could affect a Debian user would be if the user had recompiled squid3 with OpenSSL supporto. I’m sure you understand that we cannot provide support for any custom built package.</div><div class=""><br class=""></div><div class="">Is there any other security issue in Debian squid3 package that you are aware of?</div><div class=""><br class=""></div><div class="">Squid3 in Debian is in very good shape because Amos Jeffrey, one of the upstream developers is directly involved in packaging squid3 for Debian and is doing an excellent job keeping up with upstream fixes.</div><div class=""><br class=""></div><div class="">Best regards,</div><div class=""><br class=""></div><div class="">L</div><div class=""><br class=""></div><div class=""><div class="">
<div class=""><div style="font-family: Helvetica; orphans: 2; widows: 2;" class=""><span style="font-family: Verdana;" class="">--</span></div><div style="font-family: Helvetica; orphans: 2; widows: 2;" class=""><span style="font-family: Verdana;" class="">Luigi Gangitano -- <</span><a href="mailto:luigi@debian.org" style="font-family: Verdana;" class="">luigi@debian.org</a><span style="font-family: Verdana;" class="">> -- <</span><a href="mailto:gangitano@lugroma3.org" style="font-family: Verdana;" class="">gangitano@lugroma3.org</a><span style="font-family: Verdana;" class="">></span></div><div style="font-family: Helvetica; orphans: 2; widows: 2;" class=""><div style="font-family: Verdana;" class="">GPG: 1024D/924C0C26: 12F8 9C03 89D3 DB4A 9972 C24A F19B A618 924C 0C26</div><div style="font-family: Verdana;" class="">GPG: 4096R/2BA97CED: 8D48 5A35 FF1E 6EB7 90E5 0F6D 0284 F20C 2BA9 7CED</div></div></div>
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">Il giorno 22 gen 2016, alle ore 09:20, startrekfan <<a href="mailto:startrekfan75@freenet.de" class="">startrekfan75@freenet.de</a>> ha scritto:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class=""><span style="font-size:12.8px" class="">I didn't subscribed to the mailing list. So</span><b style="font-size:12.8px" class=""> please put my mail address into cc</b><span style="font-size:12.8px" class="">. thanks.</span><br class=""></div><div class=""><br class=""></div>I think I found a security issue that is not fixed in debian squid 3.4.8. Squid 3.4 seems to use the sha1 algorithm for dynamic certificate generation. Sha1 is unsafe. This seems to be fixed only in squid 3.5<div class=""><br class=""></div><div class="">ref: <a href="https://forum.pfsense.org/index.php?topic=99141.0" class="">https://forum.pfsense.org/index.php?topic=99141.0</a> (I think it's the same problem with debian jessie. The certificates are only generated with sha1)<br class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">2016-01-18 12:53 GMT+01:00 Martin Wuertele <span dir="ltr" class=""><<a href="mailto:martin@wuertele.net" target="_blank" class="">martin@wuertele.net</a>></span>:<br class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><br class="">
* startrekfan <<a href="mailto:startrekfan75@freenet.de" class="">startrekfan75@freenet.de</a>> [2016-01-15 23:39]:<br class="">
<span class=""><br class="">
> squid3 3.4.8 has some security issues(risks)/bugs so an upgrade to 3.5 is<br class="">
> actually only a fix of this bugs/security issues. There is no patch for<br class="">
> 3.4.8 because it's outdated. Debian Jessie is the current active release.<br class="">
> So why not fixing squid3 in Debian Jessie with an stable 3.5 update?<br class="">
<br class="">
</span>Not the version in Debian. All bugfixes are backported. Check the<br class="">
changelog, security tracker,...<br class="">
<br class="">
</blockquote></div><br class=""></div></div></div><div id="DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2" class=""><table style="border-top:1px solid #aaabb6;margin-top:30px" class="">
<tbody class=""><tr class="">
<td style="width:105px;padding-top:15px" class="">
<a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank" class=""><img src="https://ipmcdn.avast.com/images/logo-avast-v1.png" style="width: 90px; height:33px;" class=""></a>
</td>
<td style="width:470px;padding-top:20px;color:#41424e;font-size:13px;font-family:Arial,Helvetica,sans-serif;line-height:18px" class="">Diese E-Mail wurde von einem virenfreien Computer gesendet, der von Avast geschützt wird. <br class=""><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank" style="color:#4453ea" class="">www.avast.com</a> </td>
</tr>
</tbody></table>
<a href="x-msg://5/#DDB4FAA8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1" class=""></a></div>
</div></blockquote></div><br class=""></div></body></html>