CVE-2018-21246

9.8

CRITICALCVSS v3

Published

June 15, 2020

CVSS v2

7.5 HIGH

Affected

7 projects

Assigned by

MITRE

Severity scale

010

Description

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.

caddyserver/caddy

GitHubFast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

< 0.10.3NVD

caddy

Docker HubCaddy 2 is a powerful, enterprise-ready, open source web server with automatic HTTPS written in Go.

< 0.10.3NVD

caddy

Python Package Index

More on this CVE

NVD↗GitHub Advisory↗

Semester project for OOP course

< 0.10.3NVD

Caddy

ChocolateyCaddy is a powerful, extensible platform to serve your sites, services, and apps, written in Go. ## Features - **Easy configuration** with the [Caddyfile](https://caddyserver.com/docs/caddyfile) - **Powerful configuration** with its [native JSON config](https://caddyserver.com/docs/json/) - **Dynamic configuration** with the [JSON API](https://caddyserver.com/docs/api) - [**Config adapters**](https://caddyserver.com/docs/config-adapters) if you don't like JSON - **Automatic HTTPS** by default - [Let's Encrypt](https://letsencrypt.org) for public sites - Fully-managed local CA for internal names & IPs - Can coordinate with other Caddy instances in a cluster - **Stays up when other servers go down** due to TLS/OCSP/certificate-related issues - **HTTP/1.1, HTTP/2, and experimental HTTP/3** support - **Highly extensible** [modular architecture](https://caddyserver.com/docs/architecture) lets Caddy do anything without bloat - **Runs anywhere** with **no external dependencies** (not even libc) - Written in Go, a language with higher **memory safety guarantees** than other servers ## Notes - This packages installs caddy with standard [modules](https://caddyserver.com/docs/modules) only. If you need to install caddy with additional packages you need to build it with those packages included. You can use official caddy [download](https://caddyserver.com/download) page to select and build custom caddy version. Its not possible at this moment to do this via package unless it reimplements custom build.

< 0.10.3NVD

caddy

NPMcaddy =====

< 0.10.3NVD

caddy

RubyGems Caddy is an asynchronously refreshed cache that is updated on an interval to store objects that you can access quickly during requests. Caddy is great for storing information like feature flags -- accessed extremely frequently during many requests, updated relatively rarely and usually safe to be stale by some small duration.

< 0.10.3NVD

nickelser/caddy

GitHubCaddy gives you an auto-updating global cache to speed up your web requests.

< 0.10.3NVD

Security Advisories

CVE-2018-21246

Description

More on this CVE