Security update for caddy SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:10007-1 Final 1 1 2022-06-10T18:01:10Z current 2022-06-10T18:01:10Z 2022-06-10T18:01:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for caddy This update for caddy fixes the following issues: Update to version 2.5.1: * Fixed regression in Unix socket admin endpoints. * Fixed regression in caddy trust commands. * Hash-based load balancing policies (ip_hash, uri_hash, header, and cookie) use an improved highest-random-weight (HRW) algorithm for increased consistency. * Dynamic upstreams, which is the ability to get the list of upstreams at every request (more specifically, every iteration in the proxy loop of every request) rather than just once at config-load time. * Caddy will automatically try to get relevant certificates from the local Tailscale instance. * New OpenTelemetry integration. * Added new endpoints /pki/ca/<id> and /pki/ca/<id>/certificates for getting information about Caddy's managed CAs. * Rename _caddy to zsh-completion * Fix MatchPath sanitizing [bsc#1200279, CVE-2022-29718] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2022-10007 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ID6TRFNJC4CQHO4WTAHUQ4FGQUP3OZ7D/ E-Mail link for openSUSE-SU-2022:10007-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1200279 SUSE Bug 1200279 https://www.suse.com/security/cve/CVE-2022-29718/ SUSE CVE CVE-2022-29718 page SUSE Package Hub 15 SP4 openSUSE Leap 15.4 caddy-2.5.1-bp154.2.5.1 caddy-2.5.1-bp154.2.5.1 as a component of SUSE Package Hub 15 SP4 caddy-2.5.1-bp154.2.5.1 as a component of openSUSE Leap 15.4 Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. CVE-2022-29718 SUSE Package Hub 15 SP4:caddy-2.5.1-bp154.2.5.1 openSUSE Leap 15.4:caddy-2.5.1-bp154.2.5.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ID6TRFNJC4CQHO4WTAHUQ4FGQUP3OZ7D/ https://www.suse.com/security/cve/CVE-2022-29718.html CVE-2022-29718 https://bugzilla.suse.com/1200279 SUSE Bug 1200279