REDHAT-BUG-2439522: High severity Traefik traefik vulnerability
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 3.6.8
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker only needs to be able to open a connection to a vulnerable Traefik entrypoint and send the 8-byte PostgreSQL SSLRequest (STARTTLS) prelude. No authentication is required; the attacker then stalls the connection.
What is the operational impact?
Stalled connections can remain open indefinitely instead of being closed by the configured entrypoint read timeout. An attacker can use this behavior to exhaust available connections or related resources, causing denial of service.
Which deployments are affected?
Traefik versions prior to 3.6.8 are affected when handling STARTTLS requests in the described manner. The issue specifically bypasses the entrypoint respondingTimeouts.readTimeout control.
What should be done to remediate the issue?
Upgrade Traefik to version 3.6.8, which fixes the vulnerability.