CVE-2019-20894

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...

CVE-2019-20894

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...

Design/Logic Flaw

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...

CVE-2019-20894

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred...

CVE-2019-20894

CVE-2019-20894 : Traefik 2.x can allow HTTPS sessions to proceed without mutual TLS verification in certain configurations, where an ERR_BAD_SSL_CLIENT_AUTH_CERT would be expected. This describes a gap in mutual TLS authentication that could expose confidentiality to a man-in-the-middle. The prov...

PT-2020-10858 · Containous · Traefik

Name of the Vulnerable Software and Affected Versions: Traefik versions 2.x Description: The issue allows HTTPS sessions to proceed without mutual TLS verification in certain configurations, where an error should have occurred due to a bad SSL client authentication certificate. This situation can...

Containous Traefik Trust Management Issues Vulnerability

Containous Traefik is a reverse proxy and load balancer from Containous USA. A trust management issue vulnerability exists in Containous Traefik version 2.x prior to 2.1.4 and TraefikEE version 2.0.0. The vulnerability stems from the lack of an effective trust management mechanism in a networked...

Information Disclosure

github.com/containous/traefik is vulnerable to information disclosure. The attack is possible because the function preLoadConfiguration is not properly removing the certificate contents from providers before logging...

CVE-2020-9321

configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging...

CVE-2020-9321

configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging...

Code injection

configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging...

CVE-2020-9321

configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging...

CVE-2020-9321

The CVE-2020-9321 issue affects Traefik 2.x (before 2.1.4) and TraefikEE 2.0.0, where configurationwatcher.go mishandles purging of certificate contents from providers before logging. This can lead to information disclosure of certificate data because sensitive material may be logged. Exploitatio...

CVE-2020-9321

configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging...

PT-2020-20582 · Containous +1 · Traefik +2

Name of the Vulnerable Software and Affected Versions: Traefik versions 2.0.0 through 2.1.3 TraefikEE version 2.0.0 Description: The issue is related to improper certificate handling. Specifically, the configurationwatcher.go file in Traefik mishandles the purging of certificate contents from...

Security fix for the ALT Linux 10 package traefik version 1.7.14-alt1

Aug. 23, 2019 Alexey Shabalin 1.7.14-alt1 - 1.7.14 - build with golang-1.12.9 Fixes: CVE-2019-9512, CVE-2019-9514...

FreeBSD : traefik -- Denial of service in HTTP/2 (41f4baac-bf77-11e9-8d2f-5404a68ad561) (Ping Flood) (Reset Flood)

The traefik project reports : Update of dependency to go go1.12.8 resolves potential HTTP/2 denial of service in traefik. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2022 Jacques Vidrine an...

traefik -- Denial of service in HTTP/2

The traefik project reports: Update of dependency to go go1.12.8 resolves potential HTTP/2 denial of service in traefik...

Information Disclosure

github.com/containous/traefik is vulnerable to information disclosure.The API allows remote authenticated users to discover password hashes in the JSON response by reading the Basic HTTP Authentication or Digest HTTP Authentication headers, or discover a key by reading the ClientTLS section...

CVE-2019-12452

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control which is contrary to the API documentation, allows remote authenticated users to discover password hashes by reading the Basic HTT...