PT-2023-22086 · Traefik+2 · Traefik+2

Nmengin · Publicado 2023-04-07 · Atualizado 2024-06-24 · CVE-2023-29013

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.9.10 Traefik versions prior to 2.10.0-rc2

Description There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service.

Recommendations For versions prior to 2.9.10, update to version 2.9.10 or later to resolve the issue. For versions prior to 2.10.0-rc2, update to version 2.10.0-rc2 or later to resolve the issue.

Exploit

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

ALT-PU-2023-1587

ALT-PU-2023-1635

ALT-PU-2023-7095

CVE-2023-29013

ECHO-F5D5-6383-3505

GHSA-7HJ9-RV74-5G92

OPENSUSE-SU-2024:13007-1

OPENSUSE-SU-2024:14076-1

Produtos afetados

Alt Linux

Go

Traefik

Referências · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29013.json · Exploit
• https://github.com/traefik/traefik · Nota
• https://github.com/traefik/traefik/commit/4ed3964b3586565519249bbdc55eb1b961c08c49 · Correção
• https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92 · Aviso do Fabricante
• https://github.com/traefik/traefik/releases/tag/v2.9.10 · Nota
• https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2 · Nota
• https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8/m/OV40vnafAwAJ · Nota
• https://osv.dev/vulnerability/GHSA-7hj9-rv74-5g92 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2022-41717 · Nota
• https://security.netapp.com/advisory/ntap-20230517-0008 · Nota
• https://suse.com/security/cve/CVE-2023-47633 · Nota
• https://suse.com/security/cve/CVE-2022-41724 · Nota
• https://suse.com/security/cve/CVE-2023-45283 · Nota
• https://suse.com/security/cve/CVE-2023-45284 · Nota
• https://github.com/advisories/GHSA-8v5j-pwr7-w5f8 · Nota