GitHub Advisoryadvisory · Go
GHSA-8g85-whqh-cr2f Traefik vulnerable to potential DDoS via ACME HTTPChallenge
MEDIUM
Official page ↗
- Aliases
- CVE-2023-47124
- Ecosystem
- Go
- Packages
- github.com/traefik/traefik/v2, github.com/traefik/traefik/v3
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400, CWE-772
- Reviewed
- 2023-12-05
Affected packages
• Go github.com/traefik/traefik/v2: < 2.10.6 → fixed in 2.10.6
• Go github.com/traefik/traefik/v3: < 3.0.0-beta5 → fixed in 3.0.0-beta5
Description
Impact
There is a potential vulnerability in Traefik managing the ACME HTTP challenge.
When Traefik is configured to use the HTTPChallenge to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers (slowloris attack).
Patches
• https://github.com/traefik/traefik/releases/tag/v2.10.6
• https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5
Workarounds
Replace the HTTPChallenge with the TLSChallenge or the DNSChallenge.
For more information
If you have any questions or comments about this advisory, please open an issue.
Related
Alias · CVE (1)
- CVE-2023-47124 Traefik is an open source HTTP reverse proxy and load balancer. vulnerability
References
- https://github.com/traefik/traefik/security/advisories/GHSA-8g85-whqh-cr2f web
- https://nvd.nist.gov/vuln/detail/CVE-2023-47124 advisory
- https://doc.traefik.io/traefik/https/acme/#dnschallenge web
- https://doc.traefik.io/traefik/https/acme/#httpchallenge web
- https://doc.traefik.io/traefik/https/acme/#tlschallenge web
- https://github.com/traefik/traefik package
- https://github.com/traefik/traefik/releases/tag/v2.10.6 web
- https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5 web
- https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris web