ALT-PU-2026-8511: package caddy update to version 2.11.3-alt1
Описание
This update upgrades caddy to version 2.11.3-alt1.
Устраненные уязвимости4
Ссылки5
GHSA-7r4p-vjf4-gxv4
https://github.com/advisories/GHSA-7r4p-vjf4-gxv4GHSA-m2w3-8f23-hxxf
https://github.com/advisories/GHSA-m2w3-8f23-hxxfGHSA-m675-2p33-xv9g
https://github.com/advisories/GHSA-m675-2p33-xv9gGHSA-x5w9-xh9r-mvfc
https://github.com/advisories/GHSA-x5w9-xh9r-mvfcСвязанные уязвимости
Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.
Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.
Caddy is an extensible server platform that uses TLS by default. From ...
Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the vars_regexp matcher in vars.go:337 double-expands user-controlled input through the Caddy replacer. When vars_regexp matches against a placeholder like {http.request.header.X-Input}, the header value gets resolved once (expected), then passed through repl.ReplaceAll() again (the bug). This means an attacker can put {env.DATABASE_URL} or {file./etc/passwd} in a request header and the server will evaluate it, leaking environment variables, file contents, and system info. This issue has been patched in version 2.11.2.