CVE-2020-9321: High severity Traefik traefik vulnerability

Q: What is the vulnerability ID of this Traefik issue?

The vulnerability ID is CVE-2020-9321.

Q: What is the severity rating of CVE-2020-9321?

The severity rating of CVE-2020-9321 is high (7.5).

Q: Which versions of Traefik are affected by CVE-2020-9321?

Traefik versions 2.x before 2.1.4 and TraefikEE 2.0.0 are affected by CVE-2020-9321.

Q: How does CVE-2020-9321 impact the affected software?

CVE-2020-9321 mishandles the purging of certificate contents from providers before logging in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0.

Q: How can I fix CVE-2020-9321?

To fix CVE-2020-9321, update Traefik to version 2.1.4 or newer. The fix can be found in the Traefik release v2.1.4.

Published Mar 16, 2020

Updated

configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging.

Affected Software

3 affected components

Traefik traefik>=2.0.0<=2.1.4

Traefik traefik=2.0.0

Traefik Traefik Enterprise=2.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Traefik 2.x to a version that resolves this vulnerability.
Fixed in 2.1.4
Upgrade
Upgrade TraefikEE to a version that resolves this vulnerability.
Fixed in 2.0.0

Event History

Mar 16, 2020

CVE Published

via MITRE·06:14 PM

Data Sourced

via MITRE·06:14 PM

Description

Data Sourced

via NVD·07:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID of this Traefik issue?

The vulnerability ID is CVE-2020-9321.

What is the severity rating of CVE-2020-9321?

The severity rating of CVE-2020-9321 is high (7.5).

Which versions of Traefik are affected by CVE-2020-9321?

Traefik versions 2.x before 2.1.4 and TraefikEE 2.0.0 are affected by CVE-2020-9321.

How does CVE-2020-9321 impact the affected software?