Security update for caddy (moderate)

openSUSE Security Update: Security update for caddy Announcement ID: openSUSE-SU-2022:10007-1 Rating: moderate References: 1200279 Cross-References: CVE-2022-297182 Affected Products: openSUSE Backports SLE-15-SP4 An update that fixes one vulnerability is now available. Description: This update f...

OPENSUSE-SU-2022:10007-1 Security update for caddy

This update for caddy fixes the following issues: Update to version 2.5.1: Fixed regression in Unix socket admin endpoints. Fixed regression in caddy trust commands. Hash-based load balancing policies iphash, urihash, header, and cookie use an improved highest-random-weight HRW algorithm for...

Open Redirect

github.com/caddyserver/caddy is vulnerable to open redirect attacks. A remote unauthenticated attacker is able to redirect users to arbitrary web URLs by tricking the victim to click on specifically crafted links...

GHSA-2927-HV3P-F3VP Open redirect in caddy

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links...

Open redirect in caddy

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links...

CVE-2022-29718

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links...

CVE-2022-29718

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links...

Open redirect

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links...

CVE-2022-29718

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links...

CVE-2022-29718

CVE-2022-29718 affects Caddy v2.4 and is an open redirect vulnerability. An unauthenticated remote attacker can trick a user into clicking a crafted link, causing the user to be redirected to an arbitrary URL. Public references confirm the issue and indicate downstream fixes: openSUSE/SUSE backpo...

CVE-2022-29718

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links...

CVE-2022-29718: URL Redirection to Untrusted Site

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links...

Caddy 输入验证错误漏洞

Caddy is an open source, cross-platform HTTP/Web server from Caddy Inc. A security vulnerability exists in Caddy version 2.4, which originates from an open redirection vulnerability. A remote attacker can exploit this vulnerability by tricking the victim user into clicking on a specially crafted...

CVE-2022-29718

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links...

mastercactapus proxyprotocol vulnerable to denial of service

headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attackers to cause a denial of service webserver panic and daemon crash via a crafted HAProxy PROXY v2 request with truncated source/destinatio...

GHSA-85C5-CCM8-VR96 mastercactapus proxyprotocol vulnerable to denial of service

headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attackers to cause a denial of service webserver panic and daemon crash via a crafted HAProxy PROXY v2 request with truncated source/destinatio...

GHSA-JF2W-MQ6R-56V8 Caddy allows enumeration of Certificates and Hostnames

Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its...

Caddy allows enumeration of Certificates and Hostnames

Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its...

Puma vulnerable to HTTP Request Smuggling

When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The following...

GHSA-H99W-9Q5R-GJQ9 Puma vulnerable to HTTP Request Smuggling

When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The following...