GitHub Advisoryadvisory · Go
GHSA-7hj9-rv74-5g92 Traefik HTTP header parsing could cause a denial of service
HIGH
Official page ↗
- Aliases
- CVE-2023-29013
- Ecosystem
- Go
- Packages
- github.com/traefik/traefik/v2
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
- Reviewed
- 2023-04-11
Affected packages
• Go github.com/traefik/traefik/v2: < 2.9.10 → fixed in 2.9.10
• Go github.com/traefik/traefik/v2: >= 2.10.0-rc1, < 2.10.0-rc2 → fixed in 2.10.0-rc2
Description
Impact
There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik.
HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service.
References
• CVE-2023-24534
Patches
• https://github.com/traefik/traefik/releases/tag/v2.9.10
• https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2
Workarounds
No workaround.
For more information
If you have any questions or comments about this advisory, please open an issue.
Related
Alias · CVE (1)
- CVE-2023-29013 Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92 web
- https://nvd.nist.gov/vuln/detail/CVE-2023-29013 advisory
- https://github.com/traefik/traefik/commit/4ed3964b3586565519249bbdc55eb1b961c08c49 web
- https://github.com/advisories/GHSA-8v5j-pwr7-w5f8 advisory
- https://github.com/traefik/traefik package
- https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2 web
- https://github.com/traefik/traefik/releases/tag/v2.9.10 web
- https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8/m/OV40vnafAwAJ web
- https://security.netapp.com/advisory/ntap-20230517-0008 web