openSUSE-SU-2022:10007-1

    Dashboard / Vulnerabilities / openSUSE-SU-2022:10007-1

    openSUSE-SU-2022:10007-1

    Published: 10 Jun 2022Last Modified: 4 Feb 2026
    Upstream:
    CVE-2022-29718

    Summary: Security update for caddy

    Details: This update for caddy fixes the following issues: Update to version 2.5.1: * Fixed regression in Unix socket admin endpoints. * Fixed regression in caddy trust commands. * Hash-based load balancing policies (ip_hash, uri_hash, header, and cookie) use an improved highest-random-weight (HRW) algorithm for increased consistency. * Dynamic upstreams, which is the ability to get the list of upstreams at every request (more specifically, every iteration in the proxy loop of every request) rather than just once at config-load time. * Caddy will automatically try to get relevant certificates from the local Tailscale instance. * New OpenTelemetry integration. * Added new endpoints /pki/ca/<id> and /pki/ca/<id>/certificates for getting information about Caddy's managed CAs. * Rename _caddy to zsh-completion * Fix MatchPath sanitizing [bsc#1200279, CVE-2022-29718]

    References: https://lists.opensuse.org/archives/list/[email protected]/thread/ID6TRFNJC4CQHO4WTAHUQ4FGQUP3OZ7D/, https://bugzilla.suse.com/1200279, https://www.suse.com/security/cve/CVE-2022-29718

    Affected packages

    Package

    Name: caddy

    Purl: pkg:rpm/suse/caddy&distro=SUSE%20Package%20Hub%2015%20SP4

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.5.1-bp154.2.5.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    openSUSE-SU-2022:10007-1 | CVE-DB