{"affected":[{"ecosystem_specific":{"binaries":[{"caddy":"2.8.4-bp156.3.3.1","caddy-bash-completion":"2.8.4-bp156.3.3.1","caddy-fish-completion":"2.8.4-bp156.3.3.1","caddy-zsh-completion":"2.8.4-bp156.3.3.1"}]},"package":{"ecosystem":"SUSE:Package Hub 15 SP6","name":"caddy","purl":"pkg:rpm/suse/caddy&distro=SUSE%20Package%20Hub%2015%20SP6"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.8.4-bp156.3.3.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"caddy":"2.8.4-bp156.3.3.1","caddy-bash-completion":"2.8.4-bp156.3.3.1","caddy-fish-completion":"2.8.4-bp156.3.3.1","caddy-zsh-completion":"2.8.4-bp156.3.3.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.6","name":"caddy","purl":"pkg:rpm/opensuse/caddy&distro=openSUSE%20Leap%2015.6"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.8.4-bp156.3.3.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for caddy fixes the following issues:\n\n- Update to version 2.8.4:\n\n  * cmd: fix regression in auto-detect of Caddyfile (#6362)\n  * Tag v2.8.3 was mistakenly made on the v2.8.2 commit and is skipped\n\n- Update to version 2.8.2:\n\n  * cmd: fix auto-detetction of .caddyfile extension (#6356)\n  * caddyhttp: properly sanitize requests for root path (#6360)\n  * caddytls: Implement certmagic.RenewalInfoGetter\n  * build(deps): bump golangci/golangci-lint-action from 5 to 6 (#6361)\n\n- Update to version 2.8.1:\n\n  * caddyhttp: Fix merging consecutive `client_ip` or `remote_ip` matchers (#6350)\n  * core: MkdirAll appDataDir in InstanceID with 0o700 (#6340)\n\n- Update to version 2.8.0:\n\n  * acmeserver: Add `sign_with_root` for Caddyfile (#6345)\n  * caddyfile: Reject global request matchers earlier (#6339)\n  * core: Fix bug in AppIfConfigured (fix #6336)\n  * fix a typo (#6333)\n  * autohttps: Move log WARN to INFO, reduce confusion (#6185)\n  * reverseproxy: Support HTTP/3 transport to backend (#6312)\n  * context: AppIfConfigured returns error; consider not-yet-provisioned modules (#6292)\n  * Fix lint error about deprecated method in smallstep/certificates/authority\n  * go.mod: Upgrade dependencies\n  * caddytls: fix permission requirement with AutomationPolicy (#6328)\n  * caddytls: remove ClientHelloSNICtxKey (#6326)\n  * caddyhttp: Trace individual middleware handlers (#6313)\n  * templates: Add `pathEscape` template function and use it in file browser (#6278)\n  * caddytls: set server name in context (#6324)\n  * chore: downgrade minimum Go version in go.mod (#6318)\n  * caddytest: normalize the JSON config (#6316)\n  * caddyhttp: New experimental handler for intercepting responses (#6232)\n  * httpcaddyfile: Set challenge ports when http_port or https_port are used\n  * logging: Add support for additional logger filters other than hostname (#6082)\n  * caddyhttp: Log 4xx as INFO; 5xx as ERROR (close #6106)\n  * Second half of 6dce493\n  * caddyhttp: Alter log message when request is unhandled (close #5182)\n  * chore: Bump Go version in CI (#6310)\n  * go.mod: go 1.22.3\n  * Fix typos (#6311)\n  * reverseproxy: Pointer to struct when loading modules; remove LazyCertPool (#6307)\n  * tracing: add trace_id var (`http.vars.trace_id` placeholder) (#6308)\n  * go.mod: CertMagic v0.21.0\n  * reverseproxy: Implement health_follow_redirects (#6302)\n  * caddypki: Allow use of root CA without a key. Fixes #6290 (#6298)\n  * go.mod: Upgrade to quic-go v0.43.1\n  * reverseproxy: HTTP transport: fix PROXY protocol initialization (#6301)\n  * caddytls: Ability to drop connections (close #6294)\n  * build(deps): bump golangci/golangci-lint-action from 4 to 5 (#6289)\n  * httpcaddyfile: Fix expression matcher shortcut in snippets (#6288)\n  * caddytls: Evict internal certs from cache based on issuer (#6266)\n  * chore: add warn logs when using deprecated fields (#6276)\n  * caddyhttp: Fix linter warning about deprecation\n  * go.mod: Upgrade to quic-go v0.43.0\n  * fileserver: Set 'Vary: Accept-Encoding' header (see #5849)\n  * events: Add debug log\n  * reverseproxy: handle buffered data during hijack (#6274)\n  * ci: remove `android` and `plan9` from cross-build workflow (#6268)\n  * run `golangci-lint run --fix --fast` (#6270)\n  * caddytls: Option to configure certificate lifetime (#6253)\n  * replacer: Implement `file.*` global replacements (#5463)\n  * caddyhttp: Address some Go 1.20 features (#6252)\n  * Quell linter (false positive)\n  * reverse_proxy: Add grace_period for SRV upstreams to Caddyfile (#6264)\n  * doc: add `verifier` in `ClientAuthentication` caddyfile marshaler doc (#6263)\n  * caddytls: Add Caddyfile support for on-demand permission module (close #6260)\n  * reverseproxy: Remove long-deprecated buffering properties\n  * reverseproxy: Reuse buffered request body even if partially drained\n  * reverseproxy: Accept EOF when buffering\n  * logging: Fix default access logger (#6251)\n  * fileserver: Improve Vary handling (#5849)\n  * cmd: Only validate config is proper JSON if config slice has data (#6250)\n  * staticresp: Use the evaluated response body for sniffing JSON content-type (#6249)\n  * encode: Slight fix for the previous commit\n  * encode: Improve Etag handling (fix #5849)\n  * httpcaddyfile: Skip automate loader if disable_certs is specified (fix #6148)\n  * caddyfile: Populate regexp matcher names by default (#6145)\n  * caddyhttp: record num. bytes read when response writer is hijacked (#6173)\n  * caddyhttp: Support multiple logger names per host (#6088)\n  * chore: fix some typos in comments (#6243)\n  * encode: Configurable compression level for zstd (#6140)\n  * caddytls: Remove shim code supporting deprecated lego-dns (#6231)\n  * connection policy: add `local_ip`  matcher (#6074)\n  * reverseproxy: Wait for both ends of websocket to close (#6175)\n  * caddytls: Upgrade ACMEz to v2; support ZeroSSL API; various fixes (#6229)\n  * caddytls: Still provision permission module if ask is specified\n  * fileserver: read etags from precomputed files (#6222)\n  * fileserver: Escape # and ? in img src (fix #6237)\n  * reverseproxy: Implement modular CA provider for TLS transport (#6065)\n  * caddyhttp: Apply auto HTTPS redir to all interfaces (fix #6226)\n  * cmd: Fix panic related to config filename (fix #5919)\n  * cmd: Assume Caddyfile based on filename prefix and suffix (#5919)\n  * admin: Make `Etag` a header, not a trailer (#6208)\n  * caddyhttp: remove duplicate strings.Count in path matcher (fixes #6233) (#6234)\n  * caddyconfig: Use empty struct instead of bool in map (close #6224) (#6227)\n  * gitignore: Add rule for caddyfile.go (#6225)\n  * chore: Fix broken links in README.md (#6223)\n  * chore: Upgrade some dependencies (#6221)\n  * caddyhttp: Add plaintext response to `file_server browse` (#6093)\n  * admin: Use xxhash for etag (#6207)\n  * modules: fix some typo in conments (#6206)\n  * caddyhttp: Replace sensitive headers with REDACTED (close #5669)\n  * caddyhttp: close quic connections when server closes (#6202)\n  * reverseproxy: Use xxhash instead of fnv32 for LB (#6203)\n  * caddyhttp: add http.request.local{,.host,.port} placeholder (#6182)\n  * chore: upgrade deps (#6198)\n  * chore: remove repetitive word (#6193)\n  * Added a null check to avoid segfault on rewrite query ops (#6191)\n  * rewrite: `uri query` replace operation (#6165)\n  * logging: support `ms` duration format and add docs (#6187)\n  * replacer: use RWMutex to protect static provider (#6184)\n  * caddyhttp: Allow `header` replacement with empty string (#6163)\n  * vars: Make nil values act as empty string instead of `'<nil>'` (#6174)\n  * chore: Update quic-go to v0.42.0 (#6176)\n  * caddyhttp: Accept XFF header values with ports, when parsing client IP (#6183)\n  * reverseproxy: configurable active health_passes and health_fails (#6154)\n  * reverseproxy: Configurable forward proxy URL (#6114)\n  * caddyhttp: upgrade to cel v0.20.0 (#6161)\n  * chore: Bump Chroma to v2.13.0, includes new Caddyfile lexer (#6169)\n  * caddyhttp: suppress flushing if the response is being buffered (#6150)\n  * chore: encode: use FlushError instead of Flush (#6168)\n  * encode: write status immediately when status code is informational (#6164)\n  * httpcaddyfile: Keep deprecated `skip_log` in directive order (#6153)\n  * httpcaddyfile: Add `RegisterDirectiveOrder` function for plugin authors (#5865)\n  * rewrite: Implement `uri query` operations (#6120)\n  * fix struct names (#6151)\n  * fileserver: Preserve query during canonicalization redirect (#6109)\n  * logging: Implement `log_append` handler (#6066)\n  * httpcaddyfile: Allow nameless regexp placeholder shorthand (#6113)\n  * logging: Implement `append` encoder, allow flatter filters config (#6069)\n  * ci: fix the integration test `TestLeafCertLoaders` (#6149)\n  * vars: Allow overriding `http.auth.user.id` in replacer as a special case (#6108)\n  * caddytls: clientauth: leaf verifier: make trusted leaf certs source pluggable (#6050)\n  * cmd: Adjust config load logs/errors (#6032)\n  * reverseproxy: SRV dynamic upstream failover (#5832)\n  * ci: bump golangci/golangci-lint-action from 3 to 4 (#6141)\n  * core: OnExit hooks (#6128)\n  * cmd: fix the output of the `Usage` section (#6138)\n  * caddytls: verifier: caddyfile: re-add Caddyfile support (#6127)\n  * acmeserver: add policy field to define allow/deny rules (#5796)\n  * reverseproxy: cookie should be Secure and SameSite=None when TLS (#6115)\n  * caddytest: Rename adapt tests to `*.caddyfiletest` extension (#6119)\n  * tests: uses testing.TB interface for helper to be able to use test server in benchmarks. (#6103)\n  * caddyfile: Assert having a space after heredoc marker to simply check (#6117)\n  * chore: Update Chroma to get the new Caddyfile lexer (#6118)\n  * reverseproxy: use context.WithoutCancel (#6116)\n  * caddyfile: Reject directives in the place of site addresses (#6104)\n  * caddyhttp: Register post-shutdown callbacks (#5948)\n  * caddyhttp: Only attempt to enable full duplex for HTTP/1.x (#6102)\n  * caddyauth: Drop support for `scrypt` (#6091)\n  * Revert 'caddyfile: Reject long heredoc markers (#6098)' (#6100)\n  * caddyauth: Rename `basicauth` to `basic_auth` (#6092)\n  * logging: Inline Caddyfile syntax for `ip_mask` filter (#6094)\n  * caddyfile: Reject long heredoc markers (#6098)\n  * chore: Rename CI jobs, run on M1 mac (#6089)\n  * update comment\n  * improved list\n  * fix: add back text/*\n  * fix: add more media types to the compressed by default list\n  * acmeserver: support specifying the allowed challenge types (#5794)\n  * matchers: Drop `forwarded` option from `remote_ip` matcher (#6085)\n  * caddyhttp: Test cases for `%2F` and `%252F` (#6084)\n  * bump to golang 1.22 (#6083)\n  * fileserver: Browse can show symlink target if enabled (#5973)\n  * core: Support NO_COLOR env var to disable log coloring (#6078)\n  * build(deps): bump peter-evans/repository-dispatch from 2 to 3 (#6080)\n  * Update comment in setcap helper script\n  * caddytls: Make on-demand 'ask' permission modular (#6055)\n  * core: Add `ctx.Slogger()` which returns an `slog` logger (#5945)\n  * chore: Update quic-go to v0.41.0, bump Go minimum to 1.21 (#6043)\n  * chore: enabling a few more linters (#5961)\n  * caddyfile: Correctly close the heredoc when the closing marker appears immediately (#6062)\n  * caddyfile: Switch to slices.Equal for better performance (#6061)\n  * tls: modularize trusted CA providers (#5784)\n  * logging: Automatic `wrap` default for `filter` encoder (#5980)\n  * caddyhttp: Fix panic when request missing ClientIPVarKey (#6040)\n  * caddyfile: Normalize & flatten all unmarshalers (#6037)\n  * cmd: reverseproxy: log: use caddy logger (#6042)\n  * matchers: `query` now ANDs multiple keys (#6054)\n  * caddyfile: Add heredoc support to `fmt` command (#6056)\n  * refactor: move automaxprocs init in caddycmd.Main()\n  * caddyfile: Allow heredoc blank lines (#6051)\n  * httpcaddyfile: Add optional status code argument to `handle_errors` directive (#5965)\n  * httpcaddyfile: Rewrite `root` and `rewrite` parsing to allow omitting matcher (#5844)\n  * fileserver: Implement caddyfile.Unmarshaler interface (#5850)\n  * reverseproxy: Add `tls_curves` option to HTTP transport (#5851)\n  * caddyhttp: Security enhancements for client IP parsing (#5805)\n  * replacer: Fix escaped closing braces (#5995)\n  * filesystem: Globally declared filesystems, `fs` directive (#5833)\n  * ci/cd: use the build tag `nobadger` to exclude badgerdb (#6031)\n  * httpcaddyfile: Fix redir <to> html (#6001)\n  * httpcaddyfile: Support client auth verifiers (#6022)\n  * tls: add reuse_private_keys (#6025)\n  * reverseproxy: Only change Content-Length when full request is buffered (#5830)\n  * Switch Solaris-derivatives away from listen_unix (#6021)\n  * build(deps): bump actions/upload-artifact from 3 to 4 (#6013)\n  * build(deps): bump actions/setup-go from 4 to 5 (#6012)\n  * chore: check against errors of `io/fs` instead of `os` (#6011)\n  * caddyhttp: support unix sockets in `caddy respond` command (#6010)\n  * fileserver: Add total file size to directory listing (#6003)\n  * httpcaddyfile: Fix cert file decoding to load multiple PEM in one file (#5997)\n  * build(deps): bump golang.org/x/crypto from 0.16.0 to 0.17.0 (#5994)\n  * cmd: use automaxprocs for better perf in containers (#5711)\n  * logging: Add `zap.Option` support (#5944)\n  * httpcaddyfile: Sort skip_hosts for deterministic JSON (#5990)\n  * metrics: Record request metrics on HTTP errors (#5979)\n  * go.mod: Updated quic-go to v0.40.1 (#5983)\n  * fileserver: Enable compression for command by default (#5855)\n  * fileserver: New --precompressed flag (#5880)\n  * caddyhttp: Add `uuid` to access logs when used (#5859)\n  * proxyprotocol: use github.com/pires/go-proxyproto (#5915)\n  * cmd: Preserve LastModified date when exporting storage (#5968)\n  * core: Always make AppDataDir for InstanceID (#5976)\n  * chore: cross-build for AIX (#5971)\n  * caddytls: Sync distributed storage cleaning (#5940)\n  * caddytls: Context to DecisionFunc (#5923)\n  * tls: accept placeholders in string values of certificate loaders (#5963)\n  * templates: Offically make templates extensible (#5939)\n  * http2 uses new round-robin scheduler (#5946)\n  * panic when reading from backend failed to propagate stream error (#5952)\n  * chore: Bump otel to v1.21.0. (#5949)\n  * httpredirectlistener: Only set read limit for when request is HTTP (#5917)\n  * fileserver: Add .m4v for browse template icon\n  * Revert 'caddyhttp: Use sync.Pool to reduce lengthReader allocations (#5848)' (#5924)\n  * go.mod: update quic-go version to v0.40.0 (#5922)\n  * update quic-go to v0.39.3 (#5918)\n  * chore: Fix usage pool comment (#5916)\n  * test: acmeserver: add smoke test for the ACME server directory (#5914)\n  *  Upgrade acmeserver to github.com/go-chi/chi/v5 (#5913)\n  * caddyhttp: Adjust `scheme` placeholder docs (#5910)\n  * go.mod: Upgrade quic-go to v0.39.1\n  * go.mod: CVE-2023-45142 Update opentelemetry (#5908)\n  * templates: Delete headers on `httpError` to reset to clean slate (#5905)\n  * httpcaddyfile: Remove port from logger names (#5881)\n  * core: Apply SO_REUSEPORT to UDP sockets (#5725)\n  * caddyhttp: Use sync.Pool to reduce lengthReader allocations (#5848)\n  * cmd: Add newline character to version string in CLI output (#5895)\n  * core: quic listener will manage the underlying socket by itself (#5749)\n  * templates: Clarify `include` args docs, add `.ClientIP` (#5898)\n  * httpcaddyfile: Fix TLS automation policy merging with get_certificate (#5896)\n  * cmd: upgrade: resolve symlink of the executable (#5891)\n  * caddyfile: Fix variadic placeholder false positive when token contains `:` (#5883)\n\n- CVEs:\n  * CVE-2024-22189 (boo#1222468)\n  * CVE-2023-45142\n\n- Update to version 2.7.6:\n\n  * caddytls: Sync distributed storage cleaning (#5940)\n  * caddytls: Context to DecisionFunc (#5923)\n  * tls: accept placeholders in string values of certificate loaders (#5963)\n  * templates: Offically make templates extensible (#5939)\n  * http2 uses new round-robin scheduler (#5946)\n  * panic when reading from backend failed to propagate stream error (#5952)\n  * chore: Bump otel to v1.21.0. (#5949)\n  * httpredirectlistener: Only set read limit for when request is HTTP (#5917)\n  * fileserver: Add .m4v for browse template icon\n  * Revert 'caddyhttp: Use sync.Pool to reduce lengthReader allocations (#5848)' (#5924)\n  * go.mod: update quic-go version to v0.40.0 (#5922)\n  * update quic-go to v0.39.3 (#5918)\n  * chore: Fix usage pool comment (#5916)\n  * test: acmeserver: add smoke test for the ACME server directory (#5914)\n  * Upgrade acmeserver to github.com/go-chi/chi/v5 (#5913)\n  * caddyhttp: Adjust `scheme` placeholder docs (#5910)\n  * go.mod: Upgrade quic-go to v0.39.1\n  * go.mod: CVE-2023-45142 Update opentelemetry (#5908)\n  * templates: Delete headers on `httpError` to reset to clean slate (#5905)\n  * httpcaddyfile: Remove port from logger names (#5881)\n  * core: Apply SO_REUSEPORT to UDP sockets (#5725)\n  * caddyhttp: Use sync.Pool to reduce lengthReader allocations (#5848)\n  * cmd: Add newline character to version string in CLI output (#5895)\n  * core: quic listener will manage the underlying socket by itself (#5749)\n  * templates: Clarify `include` args docs, add `.ClientIP` (#5898)\n  * httpcaddyfile: Fix TLS automation policy merging with get_certificate (#5896)\n  * cmd: upgrade: resolve symlink of the executable (#5891)\n  * caddyfile: Fix variadic placeholder false positive when token contains `:` (#5883)\n\n- Update to version 2.7.5:\n\n  * admin: Respond with 4xx on non-existing config path (#5870)\n  * ci: Force the Go version for govulncheck (#5879)\n  * fileserver: Set canonical URL on browse template (#5867)\n  * tls: Add X25519Kyber768Draft00 PQ 'curve' behind build tag (#5852)\n  * reverseproxy: Add more debug logs (#5793)\n  * reverseproxy: Fix `least_conn` policy regression (#5862)\n  * reverseproxy: Add logging for dynamic A upstreams (#5857)\n  * reverseproxy: Replace health header placeholders (#5861)\n  * httpcaddyfile: Sort TLS SNI matcher for deterministic JSON output (#5860)\n  * cmd: Fix exiting with custom status code, add `caddy -v` (#5874)\n  * reverseproxy: fix parsing Caddyfile fails for unlimited request/response buffers (#5828)\n  * reverseproxy: Fix retries on 'upstreams unavailable' error (#5841)\n  * httpcaddyfile: Enable TLS for catch-all site if `tls` directive is specified (#5808)\n  * encode: Add `application/wasm*` to the default content types (#5869)\n  * fileserver: Add command shortcuts `-l` and `-a` (#5854)\n  * go.mod: Upgrade dependencies incl. x/net/http\n  * templates: Add dummy `RemoteAddr` to `httpInclude` request, proxy compatibility (#5845)\n  * reverseproxy: Allow fallthrough for response handlers without routes (#5780)\n  * fix: caddytest.AssertResponseCode error message (#5853)\n  * build(deps): bump goreleaser/goreleaser-action from 4 to 5 (#5847)\n  * build(deps): bump actions/checkout from 3 to 4 (#5846)\n  * caddyhttp: Use LimitedReader for HTTPRedirectListener\n  * fileserver: browse template SVG icons and UI tweaks (#5812)\n  * reverseproxy: fix nil pointer dereference in AUpstreams.GetUpstreams (#5811)\n  * httpcaddyfile: fix placeholder shorthands in named routes (#5791)\n  * cmd: Prevent overwriting existing env vars with `--envfile` (#5803)\n  * ci: Run govulncheck (#5790)\n  * logging: query filter for array of strings (#5779)\n  * logging: Clone array on log filters, prevent side-effects (#5786)\n  * fileserver: Export BrowseTemplate\n  * ci: ensure short-sha is exported correctly on all platforms (#5781)\n  * caddyfile: Fix case where heredoc marker is empty after newline (#5769)\n  * go.mod: Update quic-go to v0.38.0 (#5772)\n  * chore: Appease gosec linter (#5777)\n  * replacer: change timezone to UTC for 'time.now.http' placeholders (#5774)\n  * caddyfile: Adjust error formatting (#5765)\n  * update quic-go to v0.37.6 (#5767)\n  * httpcaddyfile: Stricter errors for site and upstream address schemes (#5757)\n  * caddyfile: Loosen heredoc parsing (#5761)\n  * fileserver: docs: clarify the ability to produce JSON array with `browse` (#5751)\n  * fix package typo (#5764)\n","id":"openSUSE-SU-2024:0220-1","modified":"2024-07-26T10:03:44Z","published":"2024-07-26T10:03:44Z","references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QNDMJCVODSMOIFD655EHBVQRLNUDXLQK/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1222468"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-45142"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-22189"}],"related":["CVE-2023-45142","CVE-2024-22189"],"summary":"Security update for caddy","upstream":["CVE-2023-45142","CVE-2024-22189"]}