GitHub Advisory DatabaseGHSA-F7CQ-5V43-8PWP

HistoryMay 23, 2024 - 3:19 p.m.

Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop

2024-05-2315:19:41

CWE-1395

GitHub Advisory Database

github.com

traefik

vulnerability

infinite loop

malformed dns

denial of service

cve-2024-24788

patch

release

v2.11.3

v3.0.1

advisory

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.3%

JSON

Impact

There is a vulnerability in GO managing malformed DNS message, which impacts Traefik.
This vulnerability could be exploited to cause a denial of service.

References

CVE-2024-24788

Patches

Workarounds

No workaround.

For more information

If you have any questions or comments about this advisory, please open an issue.

Affected configurations

Vulners

Node

github_advisory_databasegithub.com\/traefik\/traefikRange≤1.7.34

github_advisory_databasegithub.com\/traefik\/traefik\/v3Range<3.0.1

github_advisory_databasegithub.com\/traefik\/traefik\/v2Range<2.11.3

CPENameOperatorVersion
github.com/traefik/traefikle1.7.34
github.com/traefik/traefik/v3lt3.0.1
github.com/traefik/traefik/v2lt2.11.3

Name	Operator	Version
github.com/traefik/traefik	le	1.7.34
github.com/traefik/traefik/v3	lt	3.0.1
github.com/traefik/traefik/v2	lt	2.11.3

References

github.com/advisories/GHSA-5fq7-4mxc-535h

github.com/advisories/GHSA-f7cq-5v43-8pwp

github.com/traefik/traefik/releases/tag/v2.11.3

github.com/traefik/traefik/releases/tag/v3.0.1

github.com/traefik/traefik/security/advisories/GHSA-f7cq-5v43-8pwp

www.cve.org/CVERecord?id=CVE-2024-24788