ALT-PU-2024-1254: package traefik update to version 2.10.7-alt1
Описание
This update upgrades traefik to version 2.10.7-alt1.
Устраненные уязвимости4
Ссылки4
GHSA-6fwg-jrfw-ff7p
https://github.com/advisories/GHSA-6fwg-jrfw-ff7pGHSA-8g85-whqh-cr2f
https://github.com/advisories/GHSA-8g85-whqh-cr2fGHSA-fvhj-4qfh-q2hm
https://github.com/advisories/GHSA-fvhj-4qfh-q2hmСвязанные уязвимости
ALT-PU-2024-1883: package `traefik` update to version 2.10.7-alt1
Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Traefik is an open source HTTP reverse proxy and load balancer. When a ...
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass
Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers to achieve a `slowloris attack`. This vulnerability has been patch in version 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. Users unable to upgrade should replace the `HTTPChallenge` with the `TLSChallenge` or the `DNSChallenge`.