GHSA-m7gr-5w5g-36jf — high GitHub Advisory (CVE-2022-34037) in go/github.com/caddyserver/caddy

Description

Withdrawn Advisory

This advisory has been withdrawn because it is a bug, not a vulnerability. According to the maintainer, the bug only affects the client side of the request and cannot cause a denial of service on the server.

Original Description

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) on the client side via a crafted URI.

Basic information

Type: reviewed
Severity: high
Advisory on GitHub: Open advisory ↗
Repository advisory: —
Source code: Browse source ↗
Published (advisory): 2022-07-23 00:00:22 UTC
Updated: 2024-05-06 14:22:02 UTC
GitHub reviewed: 2022-07-27 22:12:07 UTC
NVD published: 2022-07-22
Withdrawn: 2024-05-06 14:22:01 UTC

Score	Percentile
0.61%	69.52%

CVSS Scores

Base score	Version	Severity	Vector
7.5	3.1	—	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.

Identifiers

Type	Value
GHSA	GHSA-m7gr-5w5g-36jf ↗
CVE	CVE-2022-34037 ↗

CWEs

CWE id	Name
CWE-125	Out-of-bounds Read

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
go	github.com/caddyserver/caddy	< 2.5.2	2.5.2	—

Withdrawn Advisory: Out-of-bounds Read can lead to client side denial of service