GHSA-r969-783f-6jqr
Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/greenpau/caddy-security | <= 1.1.23 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to the injected protocol.Exploiting this vulnerability could lead to bypass of security mechanisms or confusion in handling TLS.
References
External links from the advisory. They lead to third-party sites.