--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2023-284c34a6cc
2023-08-03 00:32:49.761531
--------------------------------------------------------------------------------
Name : caddy
Product : Fedora EPEL 7
Version : 1.0.5
Release : 1.el7
URL :
https://caddyserver.com
Summary : Web server with automatic HTTPS
Description :
Caddy is the web server with automatic HTTPS.
This package was built with the following plugins:
http.geoip
http.realip
tls.dns.azure
tls.dns.cloudflare
tls.dns.digitalocean
tls.dns.googlecloud
tls.dns.powerdns
tls.dns.rackspace
tls.dns.route53
--------------------------------------------------------------------------------
Update Information:
This updates takes the package from version 1.0.3 to 1.0.5, the most recent
version in the v1 branch. It provides fixes for two CVEs: - CVE-2022-3064,
resolved by updating the bundled gopkg.in/yaml.v2 to 2.2.4 - CVE-2022-41717,
resolved by building with golang 1.19.10
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jul 25 2023 Carl George <carl(a)george.computer> - 1.0.5-1
- Update to version 1.0.5
- Update bundled gopkg.in/yaml.v2 to 2.2.4 to fix CVE-2022-3064, resolves rhbz#2163539
- Rebuild with golang 1.19.10 to fix CVE-2022-41717, resolves rhbz#2163603
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2163539 - CVE-2022-3064 caddy: go-yaml: Improve heuristics preventing
CPU/memory abuse by parsing malicious or large YAML documents [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=2163539
[ 2 ] Bug #2163603 - CVE-2022-41717 caddy: golang: net/http: An attacker can cause
excessive memory growth in a Go server accepting HTTP/2 requests [epel-7]
https://bugzilla.redhat.com/show_bug.cgi?id=2163603
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update caddy' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------