1215 matches found
CVE-2023-47106 Incorrect processing of fragment in the URL leads to Authorization Bypass in Traefik
Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path...
CVE-2023-47124
CVE-2023-47124 describes a DoS vector in Traefik when using HTTPChallenge to obtain/renew Let’s Encrypt TLS certificates: the 50-second delay allowed solving the challenge can be abused for a slowloris-style attack. Public details in the initial document specify impacts as a server availability r...
CVE-2023-47124 Denial of service whith ACME HTTPChallenge in Traefik
Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the HTTPChallenge to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge 50 seconds can be exploited by attackers to achieve a slowloris attack. This...
CVE-2023-47124 Denial of service whith ACME HTTPChallenge in Traefik
Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the HTTPChallenge to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge 50 seconds can be exploited by attackers to achieve a slowloris attack. This...
CVE-2023-47633
creationtimestamp| type| source ---|---|--- 2023-12-04 08:28:41+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-6fwg-jrfw-ff7p...
PT-2023-30312 · Traefik +2 · Traefik +2
Name of the Vulnerable Software and Affected Versions: Traefik versions prior to 2.10.6 Traefik versions prior to 3.0.0-beta5 Description: The issue arises when a request is sent to Traefik with a URL fragment. Traefik automatically URL encodes and forwards the fragment to the backend server,...
Containous Traefik Resource Management Error Vulnerability
Containous Traefik is a reverse proxy and load balancer from Containous USA. Traefik suffers from a resource management error vulnerability that stems from allowing 100% CPU usage...
PT-2023-30327 · Traefik +1 · Traefik +1
Name of the Vulnerable Software and Affected Versions: Traefik versions prior to 2.10.6 Traefik versions prior to 3.0.0-beta5 Description: The issue arises when Traefik is configured to use the HTTPChallenge to generate and renew Let's Encrypt TLS certificates. The delay authorized to solve the...
Containous Traefik Security Vulnerability
Containous Traefik is a reverse proxy and load balancer from Containous, USA. A security vulnerability exists in Traefik v2.10.5 and earlier, v3.0.0-beta4 and earlier, which can be exploited by an attacker to conduct a Slowloris attack when Traefik is configured to generate and update certificate...
Containous Traefik Input Validation Error Vulnerability
Containous Traefik is a reverse proxy and load balancer from US-based Containous. An input validation error vulnerability exists in Traefik v2.10.5 and earlier, v3.0.0-beta4 and earlier, which stems from the fact that when a request with a URL fragment is sent to Traefik, Traefik automatically...
PT-2023-9077 · Traefik +1 · Traefik +1
Name of the Vulnerable Software and Affected Versions: Traefik versions prior to 2.10.6 Traefik versions prior to 3.0.0-beta5 Description: The issue is related to the Traefik docker container using 100% CPU when it serves as its own backend, resulting from the Docker integration in the default...
Traefik vulnerable to HTTP/2 request causing denial of service
Impact A vulnerability CVE-2023-39325 exists in Go managing HTTP/2 requests, which impacts Traefik. This vulnerability could be exploited to cause a denial of service. References - CVE-2023-44487 - CVE-2023-39325 Patches - https://github.com/traefik/traefik/releases/tag/v2.10.5 -...
GHSA-7V4P-328V-8V5G Traefik vulnerable to HTTP/2 request causing denial of service
Impact A vulnerability CVE-2023-39325 exists in Go managing HTTP/2 requests, which impacts Traefik. This vulnerability could be exploited to cause a denial of service. References - CVE-2023-44487 - CVE-2023-39325 Patches - https://github.com/traefik/traefik/releases/tag/v2.10.5 -...
PT-2026-51489
Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.10.5 Description A flaw exists in the HTTP/2 request handling, inherited from the Go standard library implementation. A remote attacker can trigger a denial of service DoS by rapidly creating and canceling HTTP/2...
FreeBSD : traefik -- Resource exhaustion by malicious HTTP/2 client (7a1b2624-6a89-11ee-af06-5404a68ad561)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7a1b2624-6a89-11ee-af06-5404a68ad561 advisory. - A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cau...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: vault-k8s-fips, atlantis-fips, dgraph, bom, gke-gcloud-auth-plugin, kaf, hey, helm, secrets-store-csi-driver-provider-gcp, cue, prometheus-adapter-fips, cosign, cortex, dynamic-localpv-provisioner, newrelic-infrastructure-agent, kubescape, kind, kube-oidc-proxy,...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: conftest, terraform-provider-sendgrid, nginx-mainline, pulumi-kubernetes-operator, cosign, terraform, flux-notification-controller, kubevela, aactl, terraform-provider-azurerm, gitness, ip-masq-agent, dex, memcached-exporter, bom, flux-helm-controller,...
traefik -- Resource exhaustion by malicious HTTP/2 client
The traefik authors report: There is a vulnerability in GO managing HTTP/2 requests, which impacts Traefik. This vulnerability could be exploited to cause a denial of service...
Security Bulletin: Multiple security vulnerabilities affect IBM Robotic Process Automation
Summary Python, Apache Spark, Tensorflow and Traefik contain multiple vulnerabilities and are used by IBM Robotic Process Automation as part of Watson NLP CVE-2022-40898, CVE-2023-22946, CVE-2023-25658, CVE-2023-25659, CVE-2023-25660, CVE-2023-25661, CVE-2023-25662, CVE-2023-25663, CVE-2023-25664...