Fedora 40 : caddy (2023-57b1499122)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-57b1499122 advisory. Automatic update for caddy-2.7.4-1.fc40. Changelog Thu Aug 17 2023 Carl George - 2.7.4-1 - Update to version 2.7.4, resolves rhbz2232696 - Fix CVE-2023-3978,...

Fedora 40 : caddy (2024-19d093c14d)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-19d093c14d advisory. Automatic update for caddy-2.7.6-1.fc40. Changelog Fri Feb 9 2024 Carl George - 2.7.6-1 - Update to version 2.7.6 rhbz2253698 - Includes fix for CVE-2023-451...

CVE-2024-22189 vulnerabilities

Vulnerabilities for packages: cloudflared, q, caddy, k3s...

GHSA-C33X-XQRF-C478 vulnerabilities

Vulnerabilities for packages: cloudflared, q, caddy, k3s...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: step, caddy, temporal-server-fips, falcosidekick-fips, spicedb, k3s, step-ca, kube-bench-fips, trillian, amass, kine, ferretdb, kots, caddy-fips, argo-workflows, argo-workflows-fips, kube-bench, temporal-server, trillian-fips, src, wavefront-collector-for-kubernetes...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: k3s, spicedb, kube-bench, ferretdb, src, step, temporal-server, trillian, kots, caddy, argo-workflows, kine, step-ca, amass...

CVE-2024-27289 vulnerabilities

Vulnerabilities for packages: trillian, step, kots, caddy, argo-workflows, step-ca...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: k3s, spicedb, kube-bench, ferretdb, src, step, temporal-server, trillian, kots, caddy, argo-workflows, kine, step-ca, amass...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: step, caddy, temporal-server-fips, falcosidekick-fips, spicedb, k3s, step-ca, kube-bench-fips, trillian, amass, kine, ferretdb, kots, caddy-fips, argo-workflows, argo-workflows-fips, kube-bench, temporal-server, trillian-fips, src, wavefront-collector-for-kubernetes...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: step, caddy, temporal-server-fips, falcosidekick-fips, spicedb, k3s, step-ca, kube-bench-fips, trillian, amass, kine, ferretdb, kots, caddy-fips, argo-workflows, argo-workflows-fips, kube-bench, temporal-server, trillian-fips, src, wavefront-collector-for-kubernetes...

GHSA-M7WR-2XF7-CM9P vulnerabilities

Vulnerabilities for packages: kots, caddy-fips, step, step-ca, argo-workflows, argo-workflows-fips, wavefront-collector-for-kubernetes, trillian-fips, trillian, caddy...

openSUSE: Security Advisory for caddy (openSUSE-SU-2022:10080-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for caddy (openSUSE-SU-2022:10007-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-22b915e51a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Improper Restriction Of Excessive Authentication Attempts

github.com/greenpau/caddy-security is vulnerable to Improper Restriction of Excessive Authentication Attempts via the two-factor authentication 2FA. The vulnerability is due to improper 2FA timeout functionality, allowing an attackers to bypass this blocking mechanism by automating the...

HTTP Header Injection

github.com/greenpau/caddy-security is vulnerable to HTTP Header Injection. The vulnerability is due the handling of the X-Forwarded-Proto header, specifically when redirecting to the injected protocol. Exploiting this vulnerability could lead to the bypass of security mechanisms or TLS protocol...

Cross-site Scripting (XSS)

github.com/greenpau/caddy-security is vulnerable to Cross-site Scripting XSS via the Referer header. The vulnerability is due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS e.g., &, , ", ', it does not account for an attack...

Open Redirection

github.com/greenpau/caddy-security is vulnerable to Open Redirect. The vulnerability is caused when a user clicks on a specially crafted link with a redirecturl parameter while logged in, resulting in the user being redirected to an arbitrary site. The user must take an action, such as clicking o...

[SECURITY] Fedora 39 Update: caddy-2.7.6-1.fc39

Caddy is an extensible server platform that uses TLS by default...

Fedora 39 : caddy (2024-22b915e51a)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-22b915e51a advisory. Update to the latest upstream version, which includes a fix for CVE-2023-45142. https://github.com/caddyserver/caddy/releases/tag/v2.7.6 Tenable has extracte...