Lucene search

K
cve[email protected]CVE-2024-28869
HistoryApr 12, 2024 - 10:15 p.m.

CVE-2024-28869

2024-04-1222:15:07
CWE-755
web.nvd.nist.gov
37
traefik
http
reverse proxy
denial of service
cve-2024-28869
version 2.11.2
version 3.0.0-rc5
upgrade
configuration
readtimeout

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

15.5%

Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the “Content-length” request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.

Affected configurations

Vulners
Node
traefiktraefikRange<2.11.2
OR
traefiktraefikRange3.0.0-rc13.0.0-rc5
VendorProductVersionCPE
traefiktraefik*cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*
traefiktraefik*cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "vendor": "traefik",
    "product": "traefik",
    "versions": [
      {
        "version": "< 2.11.2",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0-rc1, < 3.0.0-rc5",
        "status": "affected"
      }
    ]
  }
]

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

15.5%