{"action":"Upgrade github.com/caddyserver/caddy to 0.10.13 or later.","affected":[{"fixed":"0.10.13","introduced":"0"}],"component":"github.com/caddyserver/caddy","cve_ids":["CVE-2018-21246"],"ecosystem":"Go","epss":0.02723,"exploited":false,"fixed_versions":["0.10.13"],"ghsa_id":"GHSA-gr7w-x2jp-3xgw","id":"tcs_01M5KFBB400KZCVSYA56QMM4KE","modified_at":"2023-11-08T04:00:14.482973Z","published_at":"2022-10-06T22:58:56Z","references":["https://osv.dev/vulnerability/GHSA-gr7w-x2jp-3xgw","https://nvd.nist.gov/vuln/detail/CVE-2018-21246","https://github.com/caddyserver/caddy/pull/2099","https://github.com/caddyserver/caddy/commit/4d9ee000c8d2cbcdd8284007c1e0f2da7bc3c7c3","https://bugs.gentoo.org/715214","https://github.com/caddyserver/caddy","https://github.com/caddyserver/caddy/releases/tag/v0.10.13","https://pkg.go.dev/vuln/GO-2020-0043"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-gr7w-x2jp-3xgw","url":"https://osv.dev/vulnerability/GHSA-gr7w-x2jp-3xgw"}],"summary":"Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication"}