Caddy allows enumeration of Certificates and Hostnames

Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its...

GHSA-JF2W-MQ6R-56V8 Caddy allows enumeration of Certificates and Hostnames

Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its...

Puma vulnerable to HTTP Request Smuggling

When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The following...

GHSA-H99W-9Q5R-GJQ9 Puma vulnerable to HTTP Request Smuggling

When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The following...

VulnCheck KEV: CVE-2017-5963

An issue was discovered in caddy for TYPO3 before 7.2.10. The vulnerability exists due to insufficient filtration of user-supplied data in the "paymillToken" HTTP POST parameter passed to the "caddy/Resources/Public/JavaScript/e-payment/paymill/api/php/payment.php" URL. An attacker could...

GO-2020-0043 Authentication bypass in github.com/mholt/caddy

Due to improper TLS verification when serving traffic for multiple SNIs, an attacker may bypass TLS client authentication by indicating an SNI during the TLS handshake that is different from the name in the HTTP Host header...

Caddy Authorization Issues Vulnerability

Caddy is an open source , cross-platform HTTP/Web server . A security vulnerability exists in Caddy versions prior to 0.10.13 that stems from the program not properly handling TLS client authentication. An attacker can exploit the vulnerability to bypass authentication...

CVE-2018-21246

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode...

CVE-2018-21246

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode...

Authentication flaw

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode...

CVE-2018-21246

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode...

CVE-2018-21246

Caddy before 0.10.13 mishandles TLS client authentication due to missing StrictHostMatching, enabling an authentication bypass. Affected product: Caddy web server; vulnerability in TLS client auth handling (authentication bypass). CVE-2018-21246 is documented in multiple sources (GHSA, OSV, NVD, ...

CVE-2018-21246

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode...

PT-2020-8890 · Caddy · Caddy

Name of the Vulnerable Software and Affected Versions: Caddy versions prior to 0.10.13 Description: The issue is related to the mishandling of TLS client authentication. This is caused by the lack of the StrictHostMatching mode, allowing an attacker to bypass TLS client authentication. An attacke...

Malicious Package

Overview addy-caddyclient is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Fedora 30 : caddy / etcd / hugo (2020-279c61dd70)

"Rebuilt to fix GHSA-jf24-p9p9-4rjh Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Fedora Security Advisory FEDORA-2020-279c61dd70. include"compat.inc"; if description scriptid134130; scriptversion"1.1"; scriptcvsdate"Date: 2020/02/28";...

Fedora: Security Advisory for caddy (FEDORA-2020-279c61dd70)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 30 Update: caddy-1.0.3-2.fc30

Caddy is the web server with automatic HTTPS. This package was built with the following plugins: http.geoip http.realip tls.dns.azure tls.dns.cloudflare tls.dns.digitalocean tls.dns.googlecloud tls.dns.powerdns tls.dns.rackspace tls.dns.route53...

CVE-2019-14243

CVE-2019-14243 affects the mastercactapus proxyprotocol plugin for Caddy (headerv2.go in the proxyprotocol code path) prior to version 0.0.2. The flaw allows remote attackers to trigger a denial of service (webserver panic and daemon crash) by sending a crafted HAProxy PROXY v2 request with trunc...

PT-2019-13557 · Mastercactapus +2 · Proxyprotocol +3

Name of the Vulnerable Software and Affected Versions: mastercactapus proxyprotocol versions prior to 0.0.2 mastercactapus caddy-proxyprotocol plugin versions prior to 0.0.2 for Caddy Description: The issue allows remote attackers to cause a denial of service, resulting in a webserver panic and...