GitHub Advisoryadvisory · Go

GHSA-f7cq-5v43-8pwp Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop

MEDIUM Published 2024-05-23 Modified 2024-05-23 Official page ↗
Ecosystem
Go
Packages
github.com/traefik/traefik/v2, github.com/traefik/traefik/v3, github.com/traefik/traefik
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1395
Reviewed
2024-05-23

Affected packages

• Go github.com/traefik/traefik/v2: < 2.11.3 → fixed in 2.11.3 • Go github.com/traefik/traefik/v3: < 3.0.1 → fixed in 3.0.1 • Go github.com/traefik/traefik: <= 1.7.34 (no fix yet)

Description

Impact There is a vulnerability in GO managing malformed DNS message, which impacts Traefik. This vulnerability could be exploited to cause a denial of service. References • CVE-2024-24788 Patches • https://github.com/traefik/traefik/releases/tag/v2.11.3 • https://github.com/traefik/traefik/releases/tag/v3.0.1 Workarounds No workaround. For more information If you have any questions or comments about this advisory, please open an issue.

Related

Weakness · CWE (1)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness

References