PT-2021-19947 · Traefik+1 · Traefik+1

Lowemilevauge · Published 2021-08-03 · Updated 2024-08-21 · CVE-2021-32813

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.4.13

Description The issue concerns Traefik's handling of the Connection header, which could potentially lead to a header vulnerability. Active exploitation of this issue is unlikely as it requires a removed header to lead to a privilege escalation. However, the Traefik team has addressed this issue to prevent any potential abuse. If a chain of Traefik middlewares is used and one of them sets a request header, sending a request with a certain Connection header will cause it to be removed before the request is sent, resulting in the backend not seeing the request header.

Recommendations For Traefik versions prior to 2.4.13, upgrade to version 2.4.13 to resolve the issue. As a temporary workaround, consider avoiding the use of the Connection header with specific request headers until the patch is applied. There are no known workarounds aside from upgrading to the patched version.

Fix

Weakness Enumeration

CWE-913

Related Identifiers

ALT-PU-2021-2553

ALT-PU-2021-2617

ALT-PU-2022-1253

CVE-2021-32813

ECHO-EF09-14AB-A33B

GHSA-M697-4V8F-55QG

GO-2022-0923

Affected Products

Alt Linux

Traefik

References · 8

• https://github.com/traefik/traefik/pull/8319/commits/cbaf86a93014a969b8accf39301932c17d0d73f9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32813 · Security Note
• https://osv.dev/vulnerability/GO-2022-0923 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32813 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m697-4v8f-55qg · Vendor Advisory
• https://github.com/traefik/traefik/releases/tag/v2.4.13 · Note
• https://github.com/traefik/traefik/security/advisories/GHSA-m697-4v8f-55qg · Note
• https://t.me/cvenotify/18598 · Telegram Post