PT-2022-16010 · Traefik+1 · Traefik+1

Ldez · Published 2022-12-08 · Updated 2024-08-21 · CVE-2022-23469

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.9.6

Description There is a potential issue in Traefik where the Authorization header is displayed in its debug logs. This occurs when the log level is set to DEBUG, and credentials provided using the Authorization header are then visible in the debug logs. Attackers must have access to a user's logging system to exploit this. The issue has been addressed in version 2.9.6.

Recommendations For versions prior to 2.9.6, upgrade to version 2.9.6 to resolve the issue. For users unable to upgrade, set the log level to INFO, WARN, or ERROR as a temporary workaround.

Exploit

Fix

Insertion into Log File

Information Disclosure

Weakness Enumeration

CWE-532

CWE-200

Related Identifiers

ALT-PU-2023-1270

ALT-PU-2023-1324

ALT-PU-2023-7095

CVE-2022-23469

ECHO-463D-152A-B1B7

GHSA-H2PH-VHM7-G4HP

GO-2022-1154

OPENSUSE-SU-2024:12615-1

OPENSUSE-SU-2024:14076-1

Affected Products

Alt Linux

Traefik

References · 28

• 🔥 https://github.com/traefik/traefik/security/advisories/GHSA-h2ph-vhm7-g4hp · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23469.json · Exploit
• https://github.com/traefik/traefik/pull/9574 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23469 · Security Note
• https://osv.dev/vulnerability/GHSA-h2ph-vhm7-g4hp · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1154 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23469 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12615-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14076-1 · Vendor Advisory
• https://github.com/traefik/traefik · Note
• https://github.com/traefik/traefik/releases/tag/v2.9.6 · Note
• https://suse.com/security/cve/CVE-2022-41717 · Note
• https://suse.com/security/cve/CVE-2023-47633 · Note
• https://t.me/cvenotify/39490 · Telegram Post
• https://suse.com/security/cve/CVE-2022-41724 · Note