—

GO-2020-0043

Authentication bypass in github.com/mholt/caddy

Quick fix

GO-2020-0043 — github.com/mholt/caddy: upgrade to the fixed version with the command below.

go get github.com/mholt/caddy@v0.10.13

Details

Due to improper TLS verification when serving traffic for multiple SNIs, an attacker may bypass TLS client authentication by indicating an SNI during the TLS handshake that is different from the name in the HTTP Host header.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/mholt/caddy

Introduced in: 0Fixed in: 0.10.13

Fixgo get github.com/mholt/caddy@v0.10.13

References

https://github.com/caddyserver/caddy/pull/2099[FIX]
https://github.com/caddyserver/caddy/commit/4d9ee000c8d2cbcdd8284007c1e0f2da7bc3c7c3[FIX]
https://bugs.gentoo.org/715214[WEB]