PT-2020-10858 · Containous · Traefik

Published 2020-07-02 · Updated 2024-08-21 · CVE-2019-20894

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Traefik versions 2.x

Description The issue allows HTTPS sessions to proceed without mutual TLS verification in certain configurations, where an error should have occurred due to a bad SSL client authentication certificate. This situation can lead to improper authentication.

Recommendations For Traefik version 2.x, ensure that mutual TLS verification is properly configured to prevent HTTPS sessions from proceeding without authentication. As a temporary workaround, consider reviewing and adjusting the TLS settings to enforce strict verification of client certificates.

Exploit

Fix

Improper Authentication

Improper Certificate Validation

Weakness Enumeration

CWE-287

CWE-295

Related Identifiers

CVE-2019-20894

GHSA-Q9MP-79CP-9G8J

GO-2022-0774

Affected Products

Traefik

References · 11

• 🔥 https://github.com/containous/traefik/issues/5312 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-20894 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20894 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0774 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q9mp-79cp-9g8j · Vendor Advisory
• https://github.com/containous/traefik/commit/2b353971696717e980521b0e4baa1eba66c8d2bf · Note
• https://github.com/containous/traefik/pull/7008 · Note
• https://t.me/cvenotify/18221 · Telegram Post
• https://github.com/advisories/GHSA-q9mp-79cp-9g8j · Note
• https://t.me/cvenotify/4826 · Telegram Post
• https://t.me/cibsecurity/13230 · Telegram Post