CVE-2018-21246: 
NixOS vulnerability analysis and mitigation

Caddy before version 0.10.13 contains a security vulnerability (CVE-2018-21246) that mishandles TLS client authentication. The vulnerability allows for an authentication bypass due to the lack of StrictHostMatching mode (NVD, MITRE). The issue was discovered and disclosed in June 2020.

The vulnerability has a CVSS v3.1 Base Score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from improper authentication (CWE-287) in the TLS client authentication implementation. The vulnerability specifically relates to the absence of StrictHostMatching mode in the TLS configuration (NVD).

The vulnerability allows attackers to bypass TLS client authentication mechanisms, potentially gaining unauthorized access to protected resources. Given the CVSS score of 9.8, this represents a critical security risk with potential for high impact on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability is exploitable remotely without requiring privileges or user interaction. The attack complexity is low, making it relatively straightforward to exploit in environments where TLS client authentication is relied upon for security (NVD).

The vulnerability was fixed in Caddy version 0.10.13 with the introduction of StrictHostMatching mode for TLS client authentication. Users should upgrade to version 0.10.13 or later to address this security issue (Caddy Release).