PT-2024-18909 · Unknown · Caddy-Security
David Pokora
+2
·
Published
2024-02-16
·
Updated
2024-06-28
·
CVE-2024-21493
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
github.com/greenpau/caddy-security versions all
Description
The issue arises from improper validation of array indices when parsing a Caddyfile. Multiple parsing functions in the affected library do not check if their input values are nil before attempting to access elements, leading to potential panics due to index out of range errors. These panics during configuration file parsing can introduce ambiguity and vulnerabilities, affecting the correct interpretation and configuration of the web server.
Recommendations
For github.com/greenpau/caddy-security version all, consider implementing input validation to check for nil values before accessing array elements to prevent index out of range panics. As a temporary workaround, carefully review and validate all Caddyfile configurations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Caddy-Security