GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: vault-k8s, runc, rqlite, kpt, slsa-verifier, src, nodetaint, kube-state-metrics, k3s, falcoctl, flux-helm-controller, prometheus-adapter, aws-ebs-csi-driver, kubernetes-csi-external-provisioner, falcoctl-fips, flux-notification-controller, dynamic-localpv-provisioner...

Open Redirect

Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Open Redirect via the redirecturl parameter. An attacker could perform a phishing attack and trick users into visiting a malicious website by crafting a...

Authentication Bypass by Spoofing

Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For header due to improper input sanitization. An attacker can spoof an IP address used in the user...

HTTP Header Injection

Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to the injected protocol.Exploiting this vulnerability could lead to bypass of...

Insufficient Session Expiration

Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid even after requests...

Cross-site Scripting (XSS)

Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that...

Server-side Request Forgery (SSRF)

Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or...

Improper Restriction of Excessive Authentication Attempts

Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication 2FA. Although the application blocks the user after several failed...

Insecure Randomness

Amendment This was deemed not a vulnerability. Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted...

[SECURITY] Fedora 37 Update: caddy-2.6.4-1.fc37

Caddy is the web server with automatic HTTPS...

[SECURITY] Fedora 38 Update: caddy-2.6.4-1.fc38

Caddy is the web server with automatic HTTPS...

Fedora 38 : caddy (2023-74e5545901)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-74e5545901 advisory. This update takes caddy from 2.5.2 to 2.6.4. The primary purpose is to resolve a long standing FTBFS related to golang 1.20. The current F38 package is...

Fedora: Security Advisory for caddy (FEDORA-2023-4926525509)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for caddy (FEDORA-2023-74e5545901)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for caddy (FEDORA-2023-a258bed79b)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: caddy-2.4.6-6.fc36

Caddy is the web server with automatic HTTPS...

Fedora 36 : caddy (2023-a258bed79b)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-a258bed79b advisory. Backport of upstream fix for CVE-2022-29718. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Ness...

GO-2023-1567 Open redirect in github.com/caddyserver/caddy/v2

Due to improper request sanitization, a crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks...

SUSE CVE-2022-28923

Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs...

SUSE CVE-2022-29718

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links...