CVE-2019-20894: High severity traefik vulnerability
Published Jul 2, 2020
·Updated
Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERRBADSSLCLIENTAUTHCERT should have occurred.
Affected Software
1 affected component
Traefik traefik>=2.0.0<2.0.1
Event History
Jul 2, 2020
CVE Published
via MITRE·03:30 PM
Data Sourced
via MITRE·03:30 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-20894?
The severity of CVE-2019-20894 is rated as high with a score of 7.5.
2
How does Traefik 2.x in certain configurations allow HTTPS sessions to proceed without mutual TLS verification?
Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERR_BAD_SSL_CLIENT_AUTH_CERT should have occurred.
3
Is Microsoft Visual Studio 2022 affected by CVE-2019-20894?
Yes, Microsoft Visual Studio 2022 is affected by CVE-2019-20894.
4
Is there a fix available for CVE-2019-20894?
Yes, a fix is available for CVE-2019-20894. Refer to the provided reference for more information.
5
What is the CWE code for CVE-2019-20894?
The CWE code for CVE-2019-20894 is 295.