Github.Com Caddyserver Caddy vulnerabilities

CVE-2018-21246 [CRITICAL] CWE-287 Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.

CVE-2022-34037 [HIGH] CWE-125 Withdrawn Advisory: Out-of-bounds Read can lead to client side denial of service Withdrawn Advisory: Out-of-bounds Read can lead to client side denial of service ## Withdrawn Advisory This advisory has been withdrawn because it is a bug, not a vulnerability. According to the maintainer, the bug only affects the client side of the request and cannot cause a denial of service on the server. ## Original Description An out-of-bounds read in the rewrite function at /mo

CVE-2022-29718 [MEDIUM] CWE-601 Open redirect in caddy Open redirect in caddy Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.

CVE-2018-19148 [LOW] CWE-200 Caddy allows enumeration of Certificates and Hostnames Caddy allows enumeration of Certificates and Hostnames Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Specifically, when unable to match a Host header with a vhost in its configuration, it serves the X.509 certificate for a randomly selected vhost in its configuration. Repeated requests (with a nonexistent hostname in the Hos