Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package.
References
Configurations
History
19 Feb 2025, 15:47
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Greenpau caddy-security
Greenpau |
|
| References | () https://github.com/greenpau/caddy-security/issues/265 - Issue Tracking | |
| References | () https://github.com/greenpau/go-authcrunch/commit/ecd3725baf2683eb1519bb3c81ae41085fbf7dc2 - Patch | |
| References | () https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6248275 - Third Party Advisory | |
| References | () https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/ - Third Party Advisory | |
| CPE | cpe:2.3:a:greenpau:caddy-security:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
17 Feb 2024, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-17 05:15
Updated : 2025-02-19 15:47
NVD link : CVE-2024-21495
Mitre link : CVE-2024-21495
JSON object : View
Products Affected
greenpau
- caddy-security
CWE
No CWE.