Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2022-34037 (GCVE-0-2022-34037)
Vulnerability from cvelistv5
- n/a
▼ | URL | Tags | |
---|---|---|---|
cve@mitre.org | https://github.com/caddyserver/caddy/issues/4775 | Exploit, Issue Tracking, Patch, Third Party Advisory | |
cve@mitre.org | https://github.com/caddyserver/caddy/issues/4775#issuecomment-1203388116 | ||
af854a3a-2127-422b-91ae-364da2661108 | https://github.com/caddyserver/caddy/issues/4775 | Exploit, Issue Tracking, Patch, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://github.com/caddyserver/caddy/issues/4775#issuecomment-1203388116 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T08:16:17.148Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://github.com/caddyserver/caddy/issues/4775" }, { "tags": [ "x_transferred" ], "url": "https://github.com/caddyserver/caddy/issues/4775#issuecomment-1203388116" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an administrator\u0027s bad configuration containing a malformed request URI caused the server to return an empty reply instead of a valid HTTP response to the client." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2024-05-03T21:15:32.589872", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "url": "https://github.com/caddyserver/caddy/issues/4775" }, { "url": "https://github.com/caddyserver/caddy/issues/4775#issuecomment-1203388116" } ], "tags": [ "disputed" ] } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2022-34037", "datePublished": "2022-07-22T00:00:00", "dateReserved": "2022-06-20T00:00:00", "dateUpdated": "2024-08-03T08:16:17.148Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-34037\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2022-07-22T15:15:08.580\",\"lastModified\":\"2024-11-21T07:08:49.080\",\"vulnStatus\":\"Modified\",\"cveTags\":[{\"sourceIdentifier\":\"cve@mitre.org\",\"tags\":[\"disputed\"]}],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an administrator\u0027s bad configuration containing a malformed request URI caused the server to return an empty reply instead of a valid HTTP response to the client.\"},{\"lang\":\"es\",\"value\":\"Una lectura fuera de l\u00edmites en la funci\u00f3n rewrite en el archivo /modules/caddyhttp/rewrite/rewrite.go en Caddy v2.5.1 permite a atacantes causar una denegaci\u00f3n de servicio (DoS) por medio de un URI dise\u00f1ado\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:caddyserver:caddy:2.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CADA4E73-FE23-4494-9BAF-66084596E46F\"}]}]}],\"references\":[{\"url\":\"https://github.com/caddyserver/caddy/issues/4775\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/caddyserver/caddy/issues/4775#issuecomment-1203388116\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/caddyserver/caddy/issues/4775\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/caddyserver/caddy/issues/4775#issuecomment-1203388116\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}" } }
ghsa-m7gr-5w5g-36jf
Vulnerability from github
Withdrawn Advisory
This advisory has been withdrawn because it is a bug, not a vulnerability. According to the maintainer, the bug only affects the client side of the request and cannot cause a denial of service on the server.
Original Description
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) on the client side via a crafted URI.
{ "affected": [ { "package": { "ecosystem": "Go", "name": "github.com/caddyserver/caddy" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.5.2" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2022-34037" ], "database_specific": { "cwe_ids": [ "CWE-125" ], "github_reviewed": true, "github_reviewed_at": "2022-07-27T22:12:07Z", "nvd_published_at": "2022-07-22T15:15:00Z", "severity": "HIGH" }, "details": "## Withdrawn Advisory\nThis advisory has been withdrawn because it is a bug, not a vulnerability. According to the maintainer, the bug only affects the client side of the request and cannot cause a denial of service on the server.\n\n## Original Description\nAn out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) on the client side via a crafted URI.", "id": "GHSA-m7gr-5w5g-36jf", "modified": "2024-05-06T14:22:01Z", "published": "2022-07-23T00:00:22Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34037" }, { "type": "WEB", "url": "https://github.com/caddyserver/caddy/issues/4775" }, { "type": "WEB", "url": "https://github.com/caddyserver/caddy/issues/4775#issuecomment-1203388116" }, { "type": "WEB", "url": "https://github.com/caddyserver/caddy/commit/693e9b5283e675b56084ecc83d73176cab0ee27c" }, { "type": "PACKAGE", "url": "https://github.com/caddyserver/caddy" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "Withdrawn Advisory: Out-of-bounds Read can lead to client side denial of service", "withdrawn": "2024-05-06T14:22:01Z" }
fkie_cve-2022-34037
Vulnerability from fkie_nvd
▼ | URL | Tags | |
---|---|---|---|
cve@mitre.org | https://github.com/caddyserver/caddy/issues/4775 | Exploit, Issue Tracking, Patch, Third Party Advisory | |
cve@mitre.org | https://github.com/caddyserver/caddy/issues/4775#issuecomment-1203388116 | ||
af854a3a-2127-422b-91ae-364da2661108 | https://github.com/caddyserver/caddy/issues/4775 | Exploit, Issue Tracking, Patch, Third Party Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://github.com/caddyserver/caddy/issues/4775#issuecomment-1203388116 |
Vendor | Product | Version | |
---|---|---|---|
caddyserver | caddy | 2.5.1 |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:caddyserver:caddy:2.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "CADA4E73-FE23-4494-9BAF-66084596E46F", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [ { "sourceIdentifier": "cve@mitre.org", "tags": [ "disputed" ] } ], "descriptions": [ { "lang": "en", "value": "An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an administrator\u0027s bad configuration containing a malformed request URI caused the server to return an empty reply instead of a valid HTTP response to the client." }, { "lang": "es", "value": "Una lectura fuera de l\u00edmites en la funci\u00f3n rewrite en el archivo /modules/caddyhttp/rewrite/rewrite.go en Caddy v2.5.1 permite a atacantes causar una denegaci\u00f3n de servicio (DoS) por medio de un URI dise\u00f1ado" } ], "id": "CVE-2022-34037", "lastModified": "2024-11-21T07:08:49.080", "metrics": { "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2022-07-22T15:15:08.580", "references": [ { "source": "cve@mitre.org", "tags": [ "Exploit", "Issue Tracking", "Patch", "Third Party Advisory" ], "url": "https://github.com/caddyserver/caddy/issues/4775" }, { "source": "cve@mitre.org", "url": "https://github.com/caddyserver/caddy/issues/4775#issuecomment-1203388116" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Issue Tracking", "Patch", "Third Party Advisory" ], "url": "https://github.com/caddyserver/caddy/issues/4775" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/caddyserver/caddy/issues/4775#issuecomment-1203388116" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-125" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
opensuse-su-2024:12220-1
Vulnerability from csaf_opensuse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "caddy-2.5.2-2.1 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the caddy-2.5.2-2.1 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-12220", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_12220-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2022-34037 page", "url": "https://www.suse.com/security/cve/CVE-2022-34037/" } ], "title": "caddy-2.5.2-2.1 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:12220-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "caddy-2.5.2-2.1.aarch64", "product": { "name": "caddy-2.5.2-2.1.aarch64", "product_id": "caddy-2.5.2-2.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "caddy-2.5.2-2.1.ppc64le", "product": { "name": "caddy-2.5.2-2.1.ppc64le", "product_id": "caddy-2.5.2-2.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "caddy-2.5.2-2.1.s390x", "product": { "name": "caddy-2.5.2-2.1.s390x", "product_id": "caddy-2.5.2-2.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "caddy-2.5.2-2.1.x86_64", "product": { "name": "caddy-2.5.2-2.1.x86_64", "product_id": "caddy-2.5.2-2.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "caddy-2.5.2-2.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:caddy-2.5.2-2.1.aarch64" }, "product_reference": "caddy-2.5.2-2.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "caddy-2.5.2-2.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:caddy-2.5.2-2.1.ppc64le" }, "product_reference": "caddy-2.5.2-2.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "caddy-2.5.2-2.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:caddy-2.5.2-2.1.s390x" }, "product_reference": "caddy-2.5.2-2.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "caddy-2.5.2-2.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:caddy-2.5.2-2.1.x86_64" }, "product_reference": "caddy-2.5.2-2.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-34037", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2022-34037" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an administrator\u0027s bad configuration containing a malformed request URI caused the server to return an empty reply instead of a valid HTTP response to the client.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:caddy-2.5.2-2.1.aarch64", "openSUSE Tumbleweed:caddy-2.5.2-2.1.ppc64le", "openSUSE Tumbleweed:caddy-2.5.2-2.1.s390x", "openSUSE Tumbleweed:caddy-2.5.2-2.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2022-34037", "url": "https://www.suse.com/security/cve/CVE-2022-34037" }, { "category": "external", "summary": "SUSE Bug 1201822 for CVE-2022-34037", "url": "https://bugzilla.suse.com/1201822" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:caddy-2.5.2-2.1.aarch64", "openSUSE Tumbleweed:caddy-2.5.2-2.1.ppc64le", "openSUSE Tumbleweed:caddy-2.5.2-2.1.s390x", "openSUSE Tumbleweed:caddy-2.5.2-2.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "openSUSE Tumbleweed:caddy-2.5.2-2.1.aarch64", "openSUSE Tumbleweed:caddy-2.5.2-2.1.ppc64le", "openSUSE Tumbleweed:caddy-2.5.2-2.1.s390x", "openSUSE Tumbleweed:caddy-2.5.2-2.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2022-34037" } ] }
opensuse-su-2022:10080-1
Vulnerability from csaf_opensuse
Notes
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for caddy", "title": "Title of the patch" }, { "category": "description", "text": "This update for caddy fixes the following issues:\n\nUpdate to version 2.5.2:\n\n* admin: expect quoted ETags (#4879)\n* headers: Only replace known placeholders (#4880)\n* reverseproxy: Err 503 if all upstreams unavailable\n* reverseproxy: Adjust new TLS Caddyfile directive names (#4872)\n* fileserver: Use safe redirects in file browser\n* admin: support ETag on config endpoints (#4579)\n* caddytls: Reuse issuer between PreCheck and Issue (#4866)\n* admin: Implement /adapt endpoint (close #4465) (#4846)\n* forwardauth: Fix case when `copy_headers` is omitted (#4856)\n* Expose several Caddy HTTP Matchers to the CEL Matcher (#4715)\n* reverseproxy: Fix double headers in response handlers (#4847)\n* reverseproxy: Fix panic when TLS is not configured (#4848)\n* reverseproxy: Skip TLS for certain configured ports (#4843)\n* forwardauth: Support renaming copied headers, block support (#4783)\n* Add comment about xcaddy to main\n* headers: Support wildcards for delete ops (close #4830) (#4831)\n* reverseproxy: Dynamic ServerName for TLS upstreams (#4836)\n* reverseproxy: Make TLS renegotiation optional\n* reverseproxy: Add renegotiation param in TLS client (#4784)\n* caddyhttp: Log error from CEL evaluation (fix #4832)\n* reverseproxy: Correct the `tls_server_name` docs (#4827)\n* reverseproxy: HTTP 504 for upstream timeouts (#4824)\n* caddytls: Make peer certificate verification pluggable (#4389)\n* reverseproxy: api: Remove misleading \u0027healthy\u0027 value\n* Fix #4822 and fix #4779\n* reverseproxy: Add --internal-certs CLI flag #3589 (#4817)\n* ci: Fix build caching on Windows (#4811)\n* templates: Add `humanize` function (#4767)\n* core: Micro-optim in run() (#4810)\n* httpcaddyfile: Add `{err.*}` placeholder shortcut (#4798)\n* templates: Documentation consistency (#4796)\n* chore: Bump quic-go to v0.27.0 (#4782)\n* reverseproxy: Support http1.1\u003eh2c (close #4777) (#4778)\n* rewrite: Handle fragment before query (fix #4775) [boo#1201822, CVE-2022-34037]\n* httpcaddyfile: Support multiple values for `default_bind` (#4774)\n", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-2022-10080", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2022_10080-1.json" }, { "category": "self", "summary": "URL for openSUSE-SU-2022:10080-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GQURFVT45F4OXOLLGP52CDBSBPTC2M4G/" }, { "category": "self", "summary": "E-Mail link for openSUSE-SU-2022:10080-1", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GQURFVT45F4OXOLLGP52CDBSBPTC2M4G/" }, { "category": "self", "summary": "SUSE Bug 1201822", "url": "https://bugzilla.suse.com/1201822" }, { "category": "self", "summary": "SUSE CVE CVE-2022-34037 page", "url": "https://www.suse.com/security/cve/CVE-2022-34037/" } ], "title": "Security update for caddy", "tracking": { "current_release_date": "2022-08-06T12:01:12Z", "generator": { "date": "2022-08-06T12:01:12Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2022:10080-1", "initial_release_date": "2022-08-06T12:01:12Z", "revision_history": [ { "date": "2022-08-06T12:01:12Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "caddy-2.5.2-bp154.2.8.1.aarch64", "product": { "name": "caddy-2.5.2-bp154.2.8.1.aarch64", "product_id": "caddy-2.5.2-bp154.2.8.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "caddy-2.5.2-bp154.2.8.1.i586", "product": { "name": "caddy-2.5.2-bp154.2.8.1.i586", "product_id": "caddy-2.5.2-bp154.2.8.1.i586" } } ], "category": "architecture", "name": "i586" }, { "branches": [ { "category": "product_version", "name": "caddy-2.5.2-bp154.2.8.1.ppc64le", "product": { "name": "caddy-2.5.2-bp154.2.8.1.ppc64le", "product_id": "caddy-2.5.2-bp154.2.8.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "caddy-2.5.2-bp154.2.8.1.s390x", "product": { "name": "caddy-2.5.2-bp154.2.8.1.s390x", "product_id": "caddy-2.5.2-bp154.2.8.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "caddy-2.5.2-bp154.2.8.1.x86_64", "product": { "name": "caddy-2.5.2-bp154.2.8.1.x86_64", "product_id": "caddy-2.5.2-bp154.2.8.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "SUSE Package Hub 15 SP4", "product": { "name": "SUSE Package Hub 15 SP4", "product_id": "SUSE Package Hub 15 SP4" } }, { "category": "product_name", "name": "openSUSE Leap 15.4", "product": { "name": "openSUSE Leap 15.4", "product_id": "openSUSE Leap 15.4", "product_identification_helper": { "cpe": "cpe:/o:opensuse:leap:15.4" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "caddy-2.5.2-bp154.2.8.1.aarch64 as component of SUSE Package Hub 15 SP4", "product_id": "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.aarch64" }, "product_reference": "caddy-2.5.2-bp154.2.8.1.aarch64", "relates_to_product_reference": "SUSE Package Hub 15 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "caddy-2.5.2-bp154.2.8.1.i586 as component of SUSE Package Hub 15 SP4", "product_id": "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.i586" }, "product_reference": "caddy-2.5.2-bp154.2.8.1.i586", "relates_to_product_reference": "SUSE Package Hub 15 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "caddy-2.5.2-bp154.2.8.1.ppc64le as component of SUSE Package Hub 15 SP4", "product_id": "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.ppc64le" }, "product_reference": "caddy-2.5.2-bp154.2.8.1.ppc64le", "relates_to_product_reference": "SUSE Package Hub 15 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "caddy-2.5.2-bp154.2.8.1.s390x as component of SUSE Package Hub 15 SP4", "product_id": "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.s390x" }, "product_reference": "caddy-2.5.2-bp154.2.8.1.s390x", "relates_to_product_reference": "SUSE Package Hub 15 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "caddy-2.5.2-bp154.2.8.1.x86_64 as component of SUSE Package Hub 15 SP4", "product_id": "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.x86_64" }, "product_reference": "caddy-2.5.2-bp154.2.8.1.x86_64", "relates_to_product_reference": "SUSE Package Hub 15 SP4" }, { "category": "default_component_of", "full_product_name": { "name": "caddy-2.5.2-bp154.2.8.1.aarch64 as component of openSUSE Leap 15.4", "product_id": "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.aarch64" }, "product_reference": "caddy-2.5.2-bp154.2.8.1.aarch64", "relates_to_product_reference": "openSUSE Leap 15.4" }, { "category": "default_component_of", "full_product_name": { "name": "caddy-2.5.2-bp154.2.8.1.i586 as component of openSUSE Leap 15.4", "product_id": "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.i586" }, "product_reference": "caddy-2.5.2-bp154.2.8.1.i586", "relates_to_product_reference": "openSUSE Leap 15.4" }, { "category": "default_component_of", "full_product_name": { "name": "caddy-2.5.2-bp154.2.8.1.ppc64le as component of openSUSE Leap 15.4", "product_id": "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.ppc64le" }, "product_reference": "caddy-2.5.2-bp154.2.8.1.ppc64le", "relates_to_product_reference": "openSUSE Leap 15.4" }, { "category": "default_component_of", "full_product_name": { "name": "caddy-2.5.2-bp154.2.8.1.s390x as component of openSUSE Leap 15.4", "product_id": "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.s390x" }, "product_reference": "caddy-2.5.2-bp154.2.8.1.s390x", "relates_to_product_reference": "openSUSE Leap 15.4" }, { "category": "default_component_of", "full_product_name": { "name": "caddy-2.5.2-bp154.2.8.1.x86_64 as component of openSUSE Leap 15.4", "product_id": "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.x86_64" }, "product_reference": "caddy-2.5.2-bp154.2.8.1.x86_64", "relates_to_product_reference": "openSUSE Leap 15.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-34037", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2022-34037" } ], "notes": [ { "category": "general", "text": "** DISPUTED ** An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an administrator\u0027s bad configuration containing a malformed request URI caused the server to return an empty reply instead of a valid HTTP response to the client.", "title": "CVE description" } ], "product_status": { "recommended": [ "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.aarch64", "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.i586", "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.ppc64le", "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.s390x", "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.x86_64", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.aarch64", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.i586", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.ppc64le", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.s390x", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2022-34037", "url": "https://www.suse.com/security/cve/CVE-2022-34037" }, { "category": "external", "summary": "SUSE Bug 1201822 for CVE-2022-34037", "url": "https://bugzilla.suse.com/1201822" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.aarch64", "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.i586", "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.ppc64le", "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.s390x", "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.x86_64", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.aarch64", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.i586", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.ppc64le", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.s390x", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.x86_64" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.aarch64", "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.i586", "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.ppc64le", "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.s390x", "SUSE Package Hub 15 SP4:caddy-2.5.2-bp154.2.8.1.x86_64", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.aarch64", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.i586", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.ppc64le", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.s390x", "openSUSE Leap 15.4:caddy-2.5.2-bp154.2.8.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2022-08-06T12:01:12Z", "details": "important" } ], "title": "CVE-2022-34037" } ] }
var-202207-1821
Vulnerability from variot
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an administrator's bad configuration containing a malformed request URI caused the server to return an empty reply instead of a valid HTTP response to the client
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202207-1821", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "caddy", "scope": "eq", "trust": 1.0, "vendor": "caddyserver", "version": "2.5.1" }, { "model": "caddy", "scope": "eq", "trust": 0.8, "vendor": "light code", "version": "2.5.1" }, { "model": "caddy", "scope": "eq", "trust": 0.8, "vendor": "light code", "version": null }, { "model": "caddy", "scope": null, "trust": 0.8, "vendor": "light code", "version": null } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-013672" }, { "db": "NVD", "id": "CVE-2022-34037" } ] }, "cve": "CVE-2022-34037", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "exploitabilityScore": 3.9, "id": "CVE-2022-34037", "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 7.5, "baseSeverity": "High", "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2022-34037", "impactScore": null, "integrityImpact": "None", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2022-34037", "trust": 1.0, "value": "HIGH" }, { "author": "NVD", "id": "CVE-2022-34037", "trust": 0.8, "value": "High" }, { "author": "CNNVD", "id": "CNNVD-202207-2274", "trust": 0.6, "value": "HIGH" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-013672" }, { "db": "CNNVD", "id": "CNNVD-202207-2274" }, { "db": "NVD", "id": "CVE-2022-34037" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI. Note: This has been disputed as a bug, not a security vulnerability, in the Caddy web server that emerged when an administrator\u0027s bad configuration containing a malformed request URI caused the server to return an empty reply instead of a valid HTTP response to the client", "sources": [ { "db": "NVD", "id": "CVE-2022-34037" }, { "db": "JVNDB", "id": "JVNDB-2022-013672" }, { "db": "VULMON", "id": "CVE-2022-34037" } ], "trust": 1.71 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2022-34037", "trust": 3.3 }, { "db": "JVNDB", "id": "JVNDB-2022-013672", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-202207-2274", "trust": 0.6 }, { "db": "VULMON", "id": "CVE-2022-34037", "trust": 0.1 } ], "sources": [ { "db": "VULMON", "id": "CVE-2022-34037" }, { "db": "JVNDB", "id": "JVNDB-2022-013672" }, { "db": "CNNVD", "id": "CNNVD-202207-2274" }, { "db": "NVD", "id": "CVE-2022-34037" } ] }, "id": "VAR-202207-1821", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VARIoT devices database", "id": null } ], "trust": 0.13392857 }, "last_update_date": "2024-08-14T15:06:15.500000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Caddy Buffer error vulnerability fix", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=201823" }, { "title": "Red Hat: ", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2022-34037" } ], "sources": [ { "db": "VULMON", "id": "CVE-2022-34037" }, { "db": "CNNVD", "id": "CNNVD-202207-2274" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-125", "trust": 1.0 }, { "problemtype": "Out-of-bounds read (CWE-125) [NVD evaluation ]", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-013672" }, { "db": "NVD", "id": "CVE-2022-34037" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.5, "url": "https://github.com/caddyserver/caddy/issues/4775" }, { "trust": 1.0, "url": "https://github.com/caddyserver/caddy/issues/4775#issuecomment-1203388116" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-34037" }, { "trust": 0.7, "url": "https://access.redhat.com/security/cve/cve-2022-34037" }, { "trust": 0.6, "url": "https://cxsecurity.com/cveshow/cve-2022-34037/" }, { "trust": 0.6, "url": "https://vigilance.fr/vulnerability/caddy-out-of-bounds-memory-reading-via-rewrite-39002" }, { "trust": 0.1, "url": "https://nvd.nist.gov" } ], "sources": [ { "db": "VULMON", "id": "CVE-2022-34037" }, { "db": "JVNDB", "id": "JVNDB-2022-013672" }, { "db": "CNNVD", "id": "CNNVD-202207-2274" }, { "db": "NVD", "id": "CVE-2022-34037" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULMON", "id": "CVE-2022-34037" }, { "db": "JVNDB", "id": "JVNDB-2022-013672" }, { "db": "CNNVD", "id": "CNNVD-202207-2274" }, { "db": "NVD", "id": "CVE-2022-34037" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2022-07-22T00:00:00", "db": "VULMON", "id": "CVE-2022-34037" }, { "date": "2023-09-11T00:00:00", "db": "JVNDB", "id": "JVNDB-2022-013672" }, { "date": "2022-07-22T00:00:00", "db": "CNNVD", "id": "CNNVD-202207-2274" }, { "date": "2022-07-22T15:15:08.580000", "db": "NVD", "id": "CVE-2022-34037" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2022-07-22T00:00:00", "db": "VULMON", "id": "CVE-2022-34037" }, { "date": "2023-09-11T08:16:00", "db": "JVNDB", "id": "JVNDB-2022-013672" }, { "date": "2022-08-09T00:00:00", "db": "CNNVD", "id": "CNNVD-202207-2274" }, { "date": "2024-08-03T09:15:11.857000", "db": "NVD", "id": "CVE-2022-34037" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-202207-2274" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Light\u00a0Code\u00a0Labs\u00a0 of \u00a0Caddy\u00a0 Out-of-bounds read vulnerability in", "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-013672" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "buffer error", "sources": [ { "db": "CNNVD", "id": "CNNVD-202207-2274" } ], "trust": 0.6 } }
gsd-2022-34037
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2022-34037", "description": "An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI.", "id": "GSD-2022-34037", "references": [ "https://www.suse.com/security/cve/CVE-2022-34037.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2022-34037" ], "details": "An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI.", "id": "GSD-2022-34037", "modified": "2023-12-13T01:19:18.607115Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2022-34037", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/caddyserver/caddy/issues/4775", "refsource": "MISC", "url": "https://github.com/caddyserver/caddy/issues/4775" } ] } }, "gitlab.com": { "advisories": [ { "affected_range": "=v2.5.1", "affected_versions": "Version 2.5.1", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cwe_ids": [ "CWE-1035", "CWE-125", "CWE-937" ], "date": "2022-07-28", "description": "An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI.", "fixed_versions": [], "identifier": "CVE-2022-34037", "identifiers": [ "CVE-2022-34037", "GHSA-m7gr-5w5g-36jf" ], "not_impacted": "", "package_slug": "go/github.com/caddyserver/caddy", "pubdate": "2022-07-22", "solution": "Unfortunately, there is no solution available yet.", "title": "Out-of-bounds Read can lead to client side denial of service", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2022-34037", "https://github.com/caddyserver/caddy/issues/4775", "https://github.com/caddyserver/caddy/commit/693e9b5283e675b56084ecc83d73176cab0ee27c", "https://github.com/advisories/GHSA-m7gr-5w5g-36jf" ], "uuid": "10592e42-f0dc-428a-a438-d457797457a2", "versions": [ { "commit": { "sha": "878b3647cb051e7563ace306c3056105348a5e8a", "tags": [ "v2.5.1" ], "timestamp": "20220506162531" }, "number": "v2.5.1" } ] } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:caddyserver:caddy:2.5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2022-34037" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-125" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/caddyserver/caddy/issues/4775", "refsource": "MISC", "tags": [ "Exploit", "Issue Tracking", "Patch", "Third Party Advisory" ], "url": "https://github.com/caddyserver/caddy/issues/4775" } ] } }, "impact": { "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } }, "lastModifiedDate": "2022-07-28T20:16Z", "publishedDate": "2022-07-22T15:15Z" } } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.