Lucene search
GoogleOSV:GHSA-7V4P-328V-8V5GHistoryOct 17, 2023 - 2:37 a.m.
Traefik vulnerable to HTTP/2 request causing denial of service
2023-10-1702:37:42
Google
osv.dev
22
traefik
http/2
denial of service
vulnerability
cve-2023-39325
go
traefik patch
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.732 High
EPSS
Percentile
98.1%
Impact
A vulnerability CVE-2023-39325 exists in Go managing HTTP/2 requests, which impacts Traefik. This vulnerability could be exploited to cause a denial of service.
References
Patches
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/traefik/traefik | lt | 3.0.0-beta4 | |
| github.com/traefik/traefik | ge | 3.0.0-beta1 | |
| github.com/traefik/traefik | lt | 2.10.5 |
Related
redhat
redhat
rocky
rocky
go-toolset:rhel8 security update
2023-10-24 18:35:47
toolbox security update
2023-11-11 23:00:15
grafana security update
2023-10-24 18:35:47
nessus
nessus
FreeBSD : traefik -- Resource exhaustion by malicious HTTP/2 client (7a1b2624-6a89-11ee-af06-5404a68ad561)
2023-10-14 00:00:00
Oracle Linux 8 : grafana (ELSA-2023-5863)
2023-10-23 00:00:00
Oracle Linux 9 : grafana (ELSA-2023-5867)
2023-10-23 00:00:00
oraclelinux
oraclelinux
olcne security update
2023-12-07 00:00:00
grafana security update
2023-10-20 00:00:00
grafana security update
2023-10-20 00:00:00
ibm
ibm
Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes API server security vulnerabilities (CVE-2023-39325 and CVE-2023-44487)
2023-12-08 09:00:02
redhatcve
redhatcve
almalinux
almalinux
Important: go-toolset:rhel8 security update
2023-10-16 00:00:00
Moderate: grafana security update
2023-10-18 00:00:00
Moderate: grafana security update
2023-10-18 00:00:00
github
github
Traefik vulnerable to HTTP/2 request causing denial of service
2023-10-17 02:37:42
osv
osv
Moderate: toolbox security update
2023-10-24 00:00:00
Moderate: toolbox security update
2023-11-11 23:00:15
Important: go-toolset:rhel8 security update
2023-10-24 18:35:47
openvas
openvas
openSUSE: Security Advisory for go1.21 (SUSE-SU-2023:4069-1)
2024-03-04 00:00:00
openSUSE: Security Advisory for go1.20 (SUSE-SU-2023:4068-1)
2024-03-04 00:00:00
Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2024-1082)
2024-01-09 00:00:00
freebsd
freebsd
traefik -- Resource exhaustion by malicious HTTP/2 client
2023-10-10 00:00:00
ubuntucve
ubuntucve
CVE-2023-44487
2023-10-10 00:00:00
CVE-2024-4438
2024-05-08 00:00:00
nvd
nvd
CVE-2024-4438
2024-05-08 09:15:09
CVE-2023-6596
2024-04-25 16:15:10
amazon
amazon
Important: golang
2023-10-16 13:45:00
Important: golang
2023-10-16 13:45:00
Low: containerd
2023-11-10 17:32:00
cve
cve
CVE-2024-4438
2024-05-08 09:15:09
CVE-2023-6596
2024-04-25 16:15:10
cvelist
cvelist
vulnrichment
vulnrichment
fedora
fedora
[SECURITY] Fedora 39 Update: golang-1.21.3-1.fc39
2023-11-03 19:02:38
[SECURITY] Fedora 37 Update: golang-1.20.10-3.fc37
2023-10-29 01:47:29
[SECURITY] Fedora 38 Update: golang-1.20.10-2.fc38
2023-10-29 01:34:45
alpinelinux
alpinelinux
CVE-2023-39325
2023-10-11 22:15:09
cbl_mariner
cbl_mariner
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.732 High
EPSS
Percentile
98.1%
Related for OSV:GHSA-7V4P-328V-8V5G