Поиск уязвимостей
Количество 8
Количество 8
BDU:2024-07712
Уязвимость обратного прокси сервера Containous Traefik, связанная с недостаточной проверкой подлинности данных, позволяющая нарушителю выполнить произвольный код
ALT-PU-2025-7693
ALT-PU-2025-7693: package `traefik` update to version 3.4.1-alt1
ALT-PU-2025-12511
ALT-PU-2025-12511: package `traefik` update to version 3.5.0-alt1
ALT-PU-2024-16593
ALT-PU-2024-16593: package `traefik` update to version 2.11.14-alt1
CVE-2024-45410
Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise, if they can be modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been addressed in release versions 2.11.9 and 3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-45410
Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise, if they can be modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been addressed in release versions 2.11.9 and 3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-45410
Traefik is a golang, Cloud Native Application Proxy. When a HTTP reque ...
GHSA-62c8-mh53-4cqv
HTTP client can manipulate custom HTTP headers that are added by Traefik
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2024-07712 Уязвимость обратного прокси сервера Containous Traefik, связанная с недостаточной проверкой подлинности данных, позволяющая нарушителю выполнить произвольный код | CVSS3: 9.8 | 2% Низкий | около 2 лет назад |
| ALT-PU-2025-7693 ALT-PU-2025-7693: package `traefik` update to version 3.4.1-alt1 | CVSS3: 9.8 | больше 1 года назад | |
| ALT-PU-2025-12511 ALT-PU-2025-12511: package `traefik` update to version 3.5.0-alt1 | CVSS3: 9.8 | около 1 года назад | |
| ALT-PU-2024-16593 ALT-PU-2024-16593: package `traefik` update to version 2.11.14-alt1 | CVSS3: 9.8 | почти 2 года назад | |
 | CVE-2024-45410 Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise, if they can be modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been addressed in release versions 2.11.9 and 3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. | CVSS3: 8.6 | 2% Низкий | около 2 лет назад |
 | CVE-2024-45410 Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise, if they can be modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been addressed in release versions 2.11.9 and 3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability. | CVSS3: 7.5 | 2% Низкий | около 2 лет назад |
| CVE-2024-45410 Traefik is a golang, Cloud Native Application Proxy. When a HTTP reque ... | CVSS3: 7.5 | 2% Низкий | около 2 лет назад |
| GHSA-62c8-mh53-4cqv HTTP client can manipulate custom HTTP headers that are added by Traefik | CVSS3: 7.5 | 2% Низкий | около 2 лет назад |
Уязвимостей на страницу