CVE-2022-46153

moderate-risk
Published 2022-12-08

Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential vulnerability in Traefik managing TLS connections. A router configured with a not well-formatted TLSOption is exposed with an empty TLSOption. For instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates. Users are advised to upgrade to version 2.9.6. Users unable to upgrade should check their logs to detect the error messages and fix your TLS options.

Do I need to act?

-
0.40% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.1/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Traefik

References (8)

Product https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options
Patch https://github.com/traefik/traefik/commit/7e3fe48b80083b41e9ff82a474a36484cabc70...
Release Notes https://github.com/traefik/traefik/releases/tag/v2.9.6
Mitigation https://github.com/traefik/traefik/security/advisories/GHSA-468w-8x39-gj5v
Product https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options
Patch https://github.com/traefik/traefik/commit/7e3fe48b80083b41e9ff82a474a36484cabc70...
Release Notes https://github.com/traefik/traefik/releases/tag/v2.9.6
Mitigation https://github.com/traefik/traefik/security/advisories/GHSA-468w-8x39-gj5v
35
/ 100
moderate-risk
Severity 28/34 · Critical
Exploitability 2/34 · Minimal
Exposure 5/34 · Minimal