Vulnerability · Published Dec 4, 2023 · Assigned by GitHub_M
CVE-2023-47633Uncontrolled Resource Consumption in Traefik
High 7.5
In plain English
A high-severity uncontrolled resource consumption in traefik from traefik. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/traefik/traefik | no fix listed | GO-2023-2377 |
| Go | github.com/traefik/traefik/v2 | 2.10.6 | GHSA-6fwg-jrfw-ff7p |
| Go | github.com/traefik/traefik/v2 | 2.10.6 | GO-2023-2377 |
| Go | github.com/traefik/traefik/v3 | 3.0.0-beta5 | GHSA-6fwg-jrfw-ff7p |
| Go | github.com/traefik/traefik/v3 | 3.0.0-beta5 | GO-2023-2377 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/traefik/traefik/security/advisories/GHSA-6fwg-jrfw-ff7p x_refsource_CONFIRM
- https://github.com/traefik/traefik/releases/tag/v2.10.6 x_refsource_MISC
- https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5 x_refsource_MISC