Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication
Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-21246US | critical9.8 | — | ||
Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode. | ||||
02
references
External citations — patches, advisories, analysis.
- https://bugs.gentoo.org/715214WEB
- https://github.com/caddyserver/caddyPACKAGE
- https://github.com/caddyserver/caddy/commit/4d9ee000c8d2cbcdd8284007c1e0f2da7bc3c7c3WEB
- https://github.com/caddyserver/caddy/pull/2099WEB
- https://github.com/caddyserver/caddy/releases/tag/v0.10.13WEB
- https://nvd.nist.gov/vuln/detail/CVE-2018-21246ADVISORY
- https://pkg.go.dev/vuln/GO-2020-0043WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan