Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode...

GHSA-GR7W-X2JP-3XGW Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode...

GHSA-GMHJ-XJFH-CF6M Caddy-SSH vulnerable to Authorization Bypass due to incorrect usage of PAM library

Not invoking a call to pamacctmgmt after a call to pamauthenticate to check the validity of a login can lead to an authorization bypass. Impact Exploitability The attack can be carried over the network. A complex non-standard configuration or a specialized condition is required for the attack to ...

openSUSE 15 Security Update : caddy (openSUSE-SU-2022:10080-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2022:10080-1 advisory. - An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of...

OPENSUSE-SU-2022:10080-1 Security update for caddy

This update for caddy fixes the following issues: Update to version 2.5.2: admin: expect quoted ETags 4879 headers: Only replace known placeholders 4880 reverseproxy: Err 503 if all upstreams unavailable reverseproxy: Adjust new TLS Caddyfile directive names 4872 fileserver: Use safe redirects in...

Security update for caddy (moderate)

openSUSE Security Update: Security update for caddy Announcement ID: openSUSE-SU-2022:10080-1 Rating: moderate References: 1201822 Cross-References: CVE-2022-34037 CVSS scores: CVE-2022-34037 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP4 A...

Fedora: Security Advisory for caddy (FEDORA-2022-5ef0bd9a27)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: caddy-2.4.6-4.fc36

Caddy is the web server with automatic HTTPS...

CVE-2022-34037

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service DoS via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an...

GHSA-M7GR-5W5G-36JF Withdrawn Advisory: Out-of-bounds Read can lead to client side denial of service

Withdrawn Advisory This advisory has been withdrawn because it is a bug, not a vulnerability. According to the maintainer, the bug only affects the client side of the request and cannot cause a denial of service on the server. Original Description An out-of-bounds read in the rewrite function at...

Withdrawn Advisory: Out-of-bounds Read can lead to client side denial of service

Withdrawn Advisory This advisory has been withdrawn because it is a bug, not a vulnerability. According to the maintainer, the bug only affects the client side of the request and cannot cause a denial of service on the server. Original Description An out-of-bounds read in the rewrite function at...

CVE-2022-34037

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service DoS via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an...

CVE-2022-34037

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service DoS via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an...

Cross site scripting

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service DoS via a crafted URI...

Caddy 缓冲区错误漏洞

Caddy is an open source, cross-platform HTTP/Web server from Caddy. A buffer error vulnerability exists in Caddy v2.5.1, which originates from an out-of-bounds read in the rewrite function of /modules/caddyhttp/rewrite/rewrite.go. An attacker could use this vulnerability to cause a denial of...

CVE-2022-34037

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service DoS via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an...

CVE-2022-34037

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service DoS via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an...

CVE-2022-34037: Out-of-bounds Read

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service DoS via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an...

CVE-2022-34037

CVE-2022-34037 describes an out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go of Caddy v2.5.1 , enabling a potential Denial of Service via a crafted URI. The OpenSUSE and OSV entries in the connected documents confirm the issue and indicate that an update to a fi...

PT-2022-21980 · Caddy +1 · Caddy +1

Name of the Vulnerable Software and Affected Versions: Caddy version 2.5.1 Description: An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go allows attackers to cause a Denial of Service DoS via a crafted URI. This issue has been disputed as a bug, not a security...