Описание
A flaw was found in Traefik. A low-privileged Kubernetes user can bypass the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references. By setting a forbidden cross-provider reference, Traefik may use a file-provider TCPServersTransport. This can lead to the exposure of privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings, resulting in information disclosure and potential integrity compromise.
Отчет
Red Hat OpenShift Dev Spaces ships a version of traefik affected by this vulnerability. The flaw allows a low-privileged Kubernetes user to bypass the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references, potentially exposing privileged backend mTLS client certificates or SPIFFE identity. Exploitation requires specific Kubernetes RBAC permissions and a crossProviderNamespaces configuration with cross-provider TCPServersTransport resources.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Dev Spaces | devspaces/traefik-rhel9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
6.4 Medium
CVSS3
Связанные уязвимости
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use a file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This is fixed in 3.6.23 and 3.7.7.
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce t ...
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A low-privileged Kubernetes user in a namespace not listed in crossProviderNamespaces can set serversTransport: foo@file on an IngressRouteTCP service, causing Traefik to accept the forbidden cross-provider reference and use a file-provider TCPServersTransport — including privileged backend mTLS client certificates, SPIFFE identity, or PROXY-protocol settings. This is fixed in 3.6.23 and 3.7.7.
6.4 Medium
CVSS3