Upstream information
Description
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having moderate severity.
| CNA (GitHub) | |
|---|---|
| Base Score | 6.3 |
| Vector | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| Attack Vector | Network |
| Attack Complexity | High |
| Attack Requirements | Present |
| Privileges Required | None |
| User Interaction | None |
| Vulnerable System Confidentiality Impact | Low |
| Vulnerable System Integrity Impact | Low |
| Vulnerable System Availability Impact | None |
| Subsequent System Confidentiality Impact | None |
| Subsequent System Integrity Impact | None |
| Subsequent System Availability Impact | None |
| CVSSv4 Version | 4.0 |
SUSE Security Advisories:
- openSUSE-SU-2024:14567-1, published Thu Dec 12 18:51:05 2024
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-4.27 |
| |
| openSUSE Tumbleweed |
| Patchnames: openSUSE-Tumbleweed-2024-14567 |
SUSE Timeline for this CVE
CVE page created: Fri Nov 29 22:01:16 2024CVE page last modified: Fri Dec 13 12:07:09 2024