CVE-2023-47124

Aliases:GHSA-8g85-whqh-cr2fGO-2023-2381
Advisory lineage Upstream: 0 Downstream: 2
Modified
Published: 04 Dec 2023, 20:20
Last modified:18 Dec 2024, 14:12

Vulnerability Summary

Overall Risk (default)
low
24/100
CVSS Score
5.9 MEDIUM
v3.1 (cve.org)
EPSS Score
0.23% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Dec 2023, 20:20
Published
Vulnerability first disclosed
18 Dec 2024, 14:12
Last Modified
Vulnerability information updated

Description

Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers to achieve a `slowloris attack`. This vulnerability has been patch in version 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. Users unable to upgrade should replace the `HTTPChallenge` with the `TLSChallenge` or the `DNSChallenge`.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.23%• Percentile: 45%

Techniques & Countermeasures

  • CWE-772•Missing Release of Resource after Effective Lifetime

    The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Affected Systems

  • github.com/traefik•traefik

    all

  • github.com/traefik/traefik•v2

    < 2.10.6

  • github.com/traefik/traefik•v3

    < 3.0.0-beta5

  • traefik•traefik

    < 2.10.6 | ≥ 3.0.0-beta1, < 3.0.0-beta5 | ≤ 2.10.5 | 3.0.0:beta1 | 3.0.0:beta2 | 3.0.0:beta3 | 3.0.0:beta4

References (10)