CVE-2022-34037: High severity caddyserver Caddy vulnerability
Withdrawn Advisory This advisory has been withdrawn because it is a bug, not a vulnerability. According to the maintainer, the bug only affects the client side of the request and cannot cause a denial of service on the server.
Original Description An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) on the client side via a crafted URI.
Other sources
An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via a crafted URI.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this out-of-bounds read in the rewrite function in Caddy v2.5.1?
The vulnerability ID for this out-of-bounds read in the rewrite function in Caddy v2.5.1 is CVE-2022-34037.
What is the severity of CVE-2022-34037?
The severity of CVE-2022-34037 is high with a CVSS score of 7.5.
How does CVE-2022-34037 impact Caddy v2.5.1?
CVE-2022-34037 allows attackers to cause a Denial of Service (DoS) by exploiting an out-of-bounds read in the rewrite function of Caddy v2.5.1.
How can I fix the out-of-bounds read vulnerability in Caddy v2.5.1?
To fix the out-of-bounds read vulnerability in Caddy v2.5.1, upgrade to a version that includes the fix, such as Caddy v2.5.2 or later.
Where can I find more information about CVE-2022-34037?
You can find more information about CVE-2022-34037 at the following reference: https://github.com/caddyserver/caddy/issues/4775.