Discover Government News


   openSUSE Security Update: Security update for caddy
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2022:10007-1
Rating:             moderate
References:         #1200279 
Cross-References:   CVE-2022-297182
Affected Products:
                    openSUSE Backports SLE-15-SP4
______________________________________________________________________________

   An update that fixes one vulnerability is now available.

Description:

   This update for caddy fixes the following issues:

   Update to version 2.5.1:

   * Fixed regression in Unix socket admin endpoints.
   * Fixed regression in caddy trust commands.
   * Hash-based load balancing policies (ip_hash, uri_hash, header, and
     cookie) use an improved highest-random-weight (HRW) algorithm for
     increased consistency.
   * Dynamic upstreams, which is the ability to get the list of upstreams at
     every request (more specifically, every iteration in the proxy loop of
     every request) rather than just once at config-load time.
   * Caddy will automatically try to get relevant certificates from the local
     Tailscale instance.
   * New OpenTelemetry integration.
   * Added new endpoints /pki/ca/ and /pki/ca//certificates for
     getting information about Caddy's managed CAs.
   * Rename _caddy to zsh-completion
   * Fix MatchPath sanitizing [bsc#1200279, CVE-2022-29718]


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP4:

      zypper in -t patch openSUSE-2022-10007=1



Package List:

   - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64):

      caddy-2.5.1-bp154.2.5.1


References:

   https://www.suse.com/security/cve/CVE-2022-297182.html
   https://bugzilla.suse.com/1200279

openSUSE: 2022:10007-1 moderate: caddy

June 15, 2022
An update that fixes one vulnerability is now available

Description

This update for caddy fixes the following issues: Update to version 2.5.1: * Fixed regression in Unix socket admin endpoints. * Fixed regression in caddy trust commands. * Hash-based load balancing policies (ip_hash, uri_hash, header, and cookie) use an improved highest-random-weight (HRW) algorithm for increased consistency. * Dynamic upstreams, which is the ability to get the list of upstreams at every request (more specifically, every iteration in the proxy loop of every request) rather than just once at config-load time. * Caddy will automatically try to get relevant certificates from the local Tailscale instance. * New OpenTelemetry integration. * Added new endpoints /pki/ca/ and /pki/ca//certificates for getting information about Caddy's managed CAs. * Rename _caddy to zsh-completion * Fix MatchPath sanitizing [bsc#1200279, CVE-2022-29718]

 

Patch

Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10007=1


Package List

- openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): caddy-2.5.1-bp154.2.5.1


References

https://www.suse.com/security/cve/CVE-2022-297182.html https://bugzilla.suse.com/1200279


Severity
Announcement ID: openSUSE-SU-2022:10007-1
Rating: moderate
Affected Products: openSUSE Backports SLE-15-SP4 .

Related News