Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 860147 (CVE-2022-34037) - <www-servers/caddy-2.5.2: oob read allows for DoS
Summary: <www-servers/caddy-2.5.2: oob read allows for DoS
Status: IN_PROGRESS
Alias: CVE-2022-34037
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL: https://github.com/caddyserver/caddy/...
Whiteboard: B3 [glsa? cleanup]
Keywords:
Depends on:
Blocks:
 
Reported: 2022-07-22 18:33 UTC by John Helmert III
Modified: 2022-07-24 04:03 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-07-22 18:33:02 UTC 
CVE-2022-34037:

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI.

Patch is in 2.5.2, please stabilize.
Comment 1 Larry the Git Cow gentoo-dev 2022-07-23 00:54:35 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=df84b88736016351b212c09fbb42442105a52cef

commit df84b88736016351b212c09fbb42442105a52cef
Author:     Zac Medico <zmedico@gentoo.org>
AuthorDate: 2022-07-23 00:53:34 +0000
Commit:     Zac Medico <zmedico@gentoo.org>
CommitDate: 2022-07-23 00:53:38 +0000

    www-servers/caddy: stabilize 2.5.2 for amd64
    
    Bug: https://bugs.gentoo.org/860147
    Signed-off-by: Zac Medico <zmedico@gentoo.org>

 www-servers/caddy/caddy-2.5.2.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-07-23 17:10:38 UTC 
Thanks! Please cleanup
Comment 3 Zac Medico gentoo-dev 2022-07-24 04:03:09 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d86a17decd7d3272645e867394d807b29c2466da

commit d86a17decd7d3272645e867394d807b29c2466da
Author:     Zac Medico <zmedico@gentoo.org>
AuthorDate: 2022-07-22 17:54:07 -0700
Commit:     Zac Medico <zmedico@gentoo.org>
CommitDate: 2022-07-22 17:54:18 -0700

    www-servers/caddy: drop 2.5.1
    
    Bug: https://bugs.gentoo.org/86014
    Signed-off-by: Zac Medico <zmedico@gentoo.org>

 www-servers/caddy/Manifest           |  2 --
 www-servers/caddy/caddy-2.5.1.ebuild | 45 ---------------------------------------------
 2 files changed, 47 deletions(-)