Upstream information

CVE-2024-39321 at MITRE

Description

Traefik is an HTTP reverse proxy and load balancer. Versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 have a vulnerability that allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses. Versions 2.11.6, 3.0.4, and 3.1.0-rc3 contain a patch for this issue. No known workarounds are available.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having important severity.

SUSE Bugzilla entry: 1227515 [NEW]

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
openSUSE Tumbleweed
  • traefik >= 3.0.4-2.1
  • traefik2 >= 2.11.6-2.1
 Patchnames:
openSUSE-Tumbleweed-2024-14181
openSUSE-Tumbleweed-2024-14182

SUSE Timeline for this CVE

CVE page created: Fri Jul 5 22:00:44 2024
CVE page last modified: Sat Jul 13 11:53:32 2024