critical9.8
CVE-2018-21246
Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication
Impact
Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/caddyserver/caddy | < 0.10.13 | 0.10.13 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Caddyserver | Caddy | before 0.10.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugs.gentoo.org/715214
- https://github.com/caddyserver/caddy/releases/tag/v0.10.13
- https://github.com/advisories/GHSA-gr7w-x2jp-3xgw
- https://nvd.nist.gov/vuln/detail/CVE-2018-21246
- https://github.com/caddyserver/caddy/commit/4d9ee000c8d2cbcdd8284007c1e0f2da7bc3c7c3
- https://github.com/caddyserver/caddy/pull/2099
- https://pkg.go.dev/vuln/GO-2020-0043