PT-2023-22086 · Traefik+2 · Traefik+2

Nmengin · Published 2023-04-07 · Updated 2024-06-24 · CVE-2023-29013

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.9.10 Traefik versions prior to 2.10.0-rc2

Description There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service.

Recommendations For versions prior to 2.9.10, update to version 2.9.10 or later to resolve the issue. For versions prior to 2.10.0-rc2, update to version 2.10.0-rc2 or later to resolve the issue.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2023-1587

ALT-PU-2023-1635

ALT-PU-2023-7095

CVE-2023-29013

ECHO-F5D5-6383-3505

GHSA-7HJ9-RV74-5G92

OPENSUSE-SU-2024:13007-1

OPENSUSE-SU-2024:14076-1

Affected Products

Alt Linux

Go

Traefik

References · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29013.json · Exploit
• https://github.com/traefik/traefik/commit/4ed3964b3586565519249bbdc55eb1b961c08c49 · Patch
• https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7hj9-rv74-5g92 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29013 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29013 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14076-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13007-1 · Vendor Advisory
• https://github.com/traefik/traefik · Note
• https://github.com/traefik/traefik/releases/tag/v2.9.10 · Note
• https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2 · Note
• https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8/m/OV40vnafAwAJ · Note
• https://suse.com/security/cve/CVE-2022-41717 · Note
• https://security.netapp.com/advisory/ntap-20230517-0008 · Note
• https://suse.com/security/cve/CVE-2023-47633 · Note