715214 – (CVE-2018-21246) www-servers/caddy: Possible TLS client auth bypass (CVE-2018-21246)

Bug 715214 (CVE-2018-21246) - www-servers/caddy: Possible TLS client auth bypass (CVE-2018-21246)

Summary: www-servers/caddy: Possible TLS client auth bypass (CVE-2018-21246)

Status:	RESOLVED FIXED

Alias:	CVE-2018-21246

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor
Assignee:	Gentoo Security

URL:	https://github.com/caddyserver/caddy/...
Whiteboard:	B4 [noglsa cve]
Keywords:

Depends on:
Blocks:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sam James archtester

2020-03-29 02:10:43 UTC

From the changelog [0]:
"tls: StrictHostMatching mode to prevent client auth bypass"

[0] https://github.com/caddyserver/caddy/releases/tag/v0.10.13

Comment 1 Sam James archtester

2020-07-18 21:03:14 UTC

Tree is clean: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=06dda2863c91c8ec869b3bd62cd23c71b8bbc72b.

GLSA vote: no!

Closing.