Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-45692 →
DEBIAN-CVE-2026-45692
Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do n...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
caddy
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
caddy
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-12+deb13u1"}]}]
Debian:14
caddy
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.4-1"}]}]
Références
- advisory security-tracker.debian.org