| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/traefik/traefik | < 2.11.4 | 2.11.4 |
| github.com/traefik/traefik/v2 | < 2.11.4 | 2.11.4 |
| github.com/traefik/traefik/v3 | ≥ 3.0.0-beta3, < 3.0.2 | 3.0.2 |
There is a vulnerability in Go managing various Is methods (IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses.
They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms.
No workaround.
If you have any questions or comments about this advisory, please open an issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free