Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential vulnerability in Traefik managing TLS connections. A router configured with a not well-formatted TLSOption is exposed with an empty TLSOption. For instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates. Users are advised to upgrade to version 2.9.6. Users unable to upgrade should check their logs to detect the error messages and fix your TLS options.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential
    vulnerability in Traefik managing TLS connections. A router configured with a not well-formatted TLSOption
    is exposed with an empty TLSOption. For instance, a route secured using an mTLS connection set with a
    wrong CA file is exposed without verifying the client certificates. Users are advised to upgrade to
    version 2.9.6. Users unable to upgrade should check their logs to detect the error messages and fix your
    TLS options. (CVE-2022-46153)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a
    potential vulnerability in Traefik displaying the Authorization header in its debug logs. In certain
    cases, if the log level is set to DEBUG, credentials provided using the Authorization header are displayed
    in the debug logs. Attackers must have access to a users logging system in order for credentials to be
    stolen. This issue has been addressed in version 2.9.6. Users are advised to upgrade. Users unable to
    upgrade may set the log level to `INFO`, `WARN`, or `ERROR`. (CVE-2022-23469)

  - Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential
    vulnerability in Traefik managing TLS connections. A router configured with a not well-formatted TLSOption
    is exposed with an empty TLSOption. For instance, a route secured using an mTLS connection set with a
    wrong CA file is exposed without verifying the client certificates. Users are advised to upgrade to
    version 2.9.6. Users unable to upgrade should check their logs to detect the error messages and fix your
    TLS options. (CVE-2022-46153)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 508da89c-78b9-11ed-854f-5404a68ad561 advisory.

  - Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a     potential vulnerability in Traefik displaying the Authorization header in its debug logs. In certain     cases, if the log level is set to DEBUG, credentials provided using the Authorization header are displayed     in the debug logs. Attackers must have access to a users logging system in order for credentials to be     stolen. This issue has been addressed in version 2.9.6. Users are advised to upgrade. Users unable to     upgrade may set the log level to `INFO`, `WARN`, or `ERROR`. (CVE-2022-23469)

  - Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential     vulnerability in Traefik managing TLS connections. A router configured with a not well-formatted TLSOption     is exposed with an empty TLSOption. For instance, a route secured using an mTLS connection set with a     wrong CA file is exposed without verifying the client certificates. Users are advised to upgrade to     version 2.9.6. Users unable to upgrade should check their logs to detect the error messages and fix your     TLS options. (CVE-2022-46153)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
409989	SCA: security update for github.com/traefik/traefik/v2 (GHSA-468w-8x39-gj5v)	Tenable Cloud Security	SCA Checks	medium
409989	SCA: security update for github.com/traefik/traefik/v2 (GHSA-468w-8x39-gj5v)	Tenable Self-Hosted Container Security	SCA Checks	medium
407414	Alpine: multiple traefik packages: security update to 2.9.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
407414	Alpine: multiple traefik packages: security update to 2.9.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
168619	FreeBSD : traefik -- multiple vulnerabilities (508da89c-78b9-11ed-854f-5404a68ad561)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2022-46153

medium

Tenable Plugins

medium

medium

medium

medium

medium