[Git][security-tracker-team/security-tracker][master] 2 commits: Take caddy

[Aron Xu (@aron)]

Aron Xu pushed to branch master at Debian Security Tracker / security-tracker


Commits:
86112682 by Aron Xu at 2026-08-10T13:42:59+08:00
Take caddy

- - - - -
d5d99eea by Aron Xu at 2026-08-10T13:46:36+08:00
Triage caddy issues

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -40878,7 +40878,14 @@ CVE-2026-52845 (Caddy is an extensible server platform that uses TLS by default.
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g
 CVE-2026-52844 (Caddy is an extensible server platform that uses TLS by default. Prior ...)
 	- caddy 2.11.4-1 (bug #1140773)
+	[trixie] - caddy <not-affected> (Windows-specific)
+	[bookworm] - caddy <not-affected> (Windows-specific)
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-qrp7-cvwr-j2c6
+	NOTE: Fixed by: https://github.com/caddyserver/caddy/commit/217a78582465e33498276aff83d9aaeb63a2f88a (v2.11.4)
+	NOTE: The bypass needs the OS to treat backslash as a path separator: the path matcher
+	NOTE: cleans with path.Clean() (POSIX, never splits on backslash) while file_server
+	NOTE: resolves with filepath.Join(). On Linux both agree, and the fix is guarded by
+	NOTE: runtime.GOOS == "windows".
 CVE-2026-52680 (Apache Kyuubi REST batch multipart upload handling uses the client-sup ...)
 	NOT-FOR-US: Apache Kyuubi
 CVE-2026-52673 (SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remo ...)
@@ -40936,7 +40943,13 @@ CVE-2026-45692 (Caddy is an extensible server platform that uses TLS by default.
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-x5w9-xh9r-mvfc
 CVE-2026-45135 (Caddy is an extensible server platform that uses TLS by default. From  ...)
 	- caddy 2.11.4-1 (bug #1140773)
+	[trixie] - caddy <not-affected> (Vulnerable code introduced later)
+	[bookworm] - caddy <not-affected> (Vulnerable code introduced later)
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-m675-2p33-xv9g
+	NOTE: Fixed by: https://github.com/caddyserver/caddy/commit/fb324331f40782ac7a48d83f591c2bb7615d7eed (v2.11.3)
+	NOTE: Introduced with: https://github.com/caddyserver/caddy/commit/7c28c0c07ac70a8960a166c7126150a408ba7464 (v2.11.0)
+	NOTE: the vulnerable window is 2.11.0 to 2.11.2. 2.6.2's splitPos() is a plain
+	NOTE: strings.Index() over a lower-cased copy; that separate flaw is CVE-2026-27590.
 CVE-2026-44792 (n8n is an open source workflow automation platform. Prior to 1.123.43, ...)
 	NOT-FOR-US: n8n
 CVE-2026-44791 (n8n is an open source workflow automation platform. Prior to 1.123.43, ...)
@@ -112357,8 +112370,14 @@ CVE-2026-27587 (Caddy is an extensible server platform that uses TLS by default.
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-g7pc-pc7g-h8jh
 CVE-2026-27586 (Caddy is an extensible server platform that uses TLS by default. Prior ...)
 	- caddy 2.11.2-1 (bug #1132041)
+	[trixie] - caddy <not-affected> (Vulnerable code introduced later)
+	[bookworm] - caddy <not-affected> (Vulnerable code introduced later)
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7
-	TODO: check, introducing version
+	NOTE: Fixed by: https://github.com/caddyserver/caddy/commit/d42d39b4bc237c628f9a95363b28044cb7a7fe72 (v2.11.1)
+	NOTE: Introduced with: https://github.com/caddyserver/caddy/commit/e965b111cdf46109b4ed87e607e8dce5225105f4 (v2.8.0)
+	NOTE: ClientAuthentication.provision(), the tls.ca_pool.source module namespace and
+	NOTE: convertPEMFilesToDER() were all added by the trusted CA provider modularization
+	NOTE: in 2.8.0; 2.6.2 has no such function and no swallowed error to fail open on.
 CVE-2026-27585 (Caddy is an extensible server platform that uses TLS by default. Prior ...)
 	- caddy 2.11.2-1 (bug #1132041)
 	NOTE: https://github.com/caddyserver/caddy/security/advisories/GHSA-4xrr-hq4w-6vf4


=====================================
data/dsa-needed.txt
=====================================
@@ -26,7 +26,7 @@ apr-util
 cacti
   probably best to move to 1.2.31
 --
-caddy
+caddy (aron)
 --
 cockpit
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/cdfc55dd2f3feed37233008320317d0c3fbe811c...d5d99eea8cce1f60da7dbf3967ac624bb37a45b3

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/cdfc55dd2f3feed37233008320317d0c3fbe811c...d5d99eea8cce1f60da7dbf3967ac624bb37a45b3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260810/6023922a/attachment-0001.htm>