CVE-2018-21246

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2020-06-15

Last modified

2024-08-05

Weaknesses

CWE-287

Affected products

• Caddy (Caddyserver)

References

• https://bugs.gentoo.org/715214
• https://github.com/caddyserver/caddy/releases/tag/v0.10.13