ALT-PU-2026-3980: package caddy update to version 2.11.1-alt1
Описание
This update upgrades caddy to version 2.11.1-alt1.
Устраненные уязвимости4
Ссылки5
GHSA-4xrr-hq4w-6vf4
https://github.com/advisories/GHSA-4xrr-hq4w-6vf4GHSA-5r3v-vc8m-m96g
https://github.com/advisories/GHSA-5r3v-vc8m-m96gGHSA-879p-475x-rqh2
https://github.com/advisories/GHSA-879p-475x-rqh2GHSA-hffm-g8v7-wrv7
https://github.com/advisories/GHSA-hffm-g8v7-wrv7Связанные уязвимости
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.
Caddy is an extensible server platform that uses TLS by default. Prior ...
Caddy: Improper sanitization of glob characters in file matcher may lead to bypassing security protections
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability.