[github.com/caddyserver/caddy/caddyhttp/httpserver] Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.

References

• https://nvd.nist.gov/vuln/detail/CVE-2018-21246
• https://github.com/caddyserver/caddy/commit/4d9ee000c8d2cbcdd8284007c1e0f2da7bc3c7c3
• https://bugs.gentoo.org/715214
• https://github.com/caddyserver/caddy/releases/tag/v0.10.13
• https://github.com/advisories/GHSA-gr7w-x2jp-3xgw