Critical · 9.8 CVE-2018-21246 EUVD-2022-7098GHSA-gr7w-x2jp-3xgwGO-2020-0043

Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication

Published Jun 15, 2020 · Updated Aug 5, 2024 · Assigned by mitre

Package: github.com/caddyserver/caddy Package: github.com/mholt/caddy Ecosystem: Go

Description

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	github.com/caddyserver/caddy	< 0.10.13	0.10.13	GHSA-gr7w-x2jp-3xgw
Go	github.com/mholt/caddy	< 0.10.13	0.10.13	GO-2020-0043

References

https://github.com/caddyserver/caddy/releases/tag/v0.10.13
https://bugs.gentoo.org/715214