| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| github.com/traefik/traefik | ≤ 1.7.30mọi phiên bản | |
| github.com/traefik/traefik/v2 | < 2.4.13 | 2.4.13 |
| traefik | < 2.4.13 | 2.4.13 |
There exists a potential header vulnerability in Traefik's handling of the Connection header. Active exploitation of this issue is unlikely, as it requires that a removed header would lead to a privilege escalation, however, the Traefik team has addressed this issue to prevent any potential abuse.
If you have a chain of Traefik middlewares, and one of them sets a request header Important-Security-Header, then sending a request with the following Connection header will cause it to be removed before the request was sent:
curl 'https://example.com' -H "Connection: Important-Security-Header" -0
In this case, the backend does not see the request header Important-Security-Header.
Traefik v2.4.x: https://github.com/traefik/traefik/releases/tag/v2.4.13
No.
If you have any questions or comments about this advisory, open an issue.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí