CVE-2020-35502
📋 TL;DR
This vulnerability in Privoxy versions before 3.0.29 involves memory leaks that occur when response buffering reaches limits or during low memory conditions. The flaw can cause the Privoxy proxy service to crash, potentially disrupting network filtering and privacy protection. Systems running vulnerable Privoxy versions as a proxy service are affected.
💻 Affected Systems
- Privoxy
📦 What is this software?
Privoxy by Privoxy
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage of Privoxy proxy, disrupting all filtered network traffic and potentially causing denial of service for dependent applications.
Likely Case
Intermittent service crashes requiring manual restart of Privoxy, causing temporary loss of proxy functionality.
If Mitigated
Service automatically restarts via monitoring tools, causing brief connectivity interruptions but maintaining overall availability.
🎯 Exploit Status
Exploitation requires triggering specific memory exhaustion conditions rather than direct code execution. No known weaponized exploits exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.29
Vendor Advisory: https://www.privoxy.org/3.0.29/user-manual/whatsnew.html
Restart Required: Yes
Instructions:
1. Download Privoxy 3.0.29 from privoxy.org 2. Stop current Privoxy service 3. Install new version 4. Restart Privoxy service
🔧 Temporary Workarounds
Memory Limit Configuration
linuxConfigure system memory limits to reduce likelihood of triggering memory exhaustion
ulimit -v 1048576
systemctl edit privoxy (add MemoryLimit=1G)
Service Monitoring and Auto-restart
linuxConfigure monitoring to automatically restart Privoxy if it crashes
systemctl edit privoxy (add Restart=always)
supervisorctl restart privoxy
🧯 If You Can't Patch
- Implement aggressive memory monitoring and alerting for Privoxy process
- Deploy redundant proxy instances with load balancing to maintain service during crashes
🔍 How to Verify
Check if Vulnerable:
Check Privoxy version with 'privoxy --version' and compare to 3.0.29Check Version:
privoxy --version | head -1Verify Fix Applied:
Verify installed version is 3.0.29 or later and monitor for crash events📡 Detection & Monitoring
Log Indicators:
- Privoxy process termination logs
- Out of memory errors in system logs
- Service restart events
Network Indicators:
- Sudden loss of proxy connectivity
- TCP connection resets from proxy
SIEM Query:
source="privoxy.log" AND ("crash" OR "terminated" OR "out of memory")🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=1928749
- https://security.gentoo.org/glsa/202107-16
- https://www.privoxy.org/3.0.29/user-manual/whatsnew.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1928749
- https://security.gentoo.org/glsa/202107-16
- https://www.privoxy.org/3.0.29/user-manual/whatsnew.html
