Update module github.com/traefik/traefik/v2 to v2.11.25 [SECURITY] #218

renovate · 2024-12-02T17:14:42Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/traefik/traefik/v2	`v2.11.10` -> `v2.11.25`

GitHub Vulnerability Alerts

CVE-2024-52003

Impact

There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source.

Patches

Workarounds

No workaround.

For more information

If you have any questions or comments about this advisory, please open an issue.

Original Description

Summary

The previously reported open redirect (GHSA-6qq8-5wq3-86rp) is not fixed correctly. The safePrefix function can be tricked to return an absolute URL.

Details

The Traefik API dashboard component tries to validate that the value of the header X-Forwarded-Prefix is a site relative path:

http.Redirect(resp, req, safePrefix(req)+"/dashboard/", http.StatusFound)

func safePrefix(req *http.Request) string {
	prefix := req.Header.Get("X-Forwarded-Prefix")
	if prefix == "" {
		return ""
	}

	parse, err := url.Parse(prefix)
	if err != nil {
		return ""
	}

	return parse.Path
}

PoC

An attacker can bypass this by sending the following payload:

curl -v 'http://traefik.localhost' -H 'X-Forwarded-Prefix: %0d//a.com'
[...]
> HTTP/1.1 302 Found
> Location: //a.com/dashboard/

or similar:

curl -v 'http://traefik.localhost' -H 'X-Forwarded-Prefix: %2f%2fa.com'
[...]
> HTTP/1.1 302 Found
> Location: //a.com/dashboard/

Impact

Similar to the previously reported bug. In cache poisoning scenarios this may be exploitable.

GHSA-hxr6-2p24-hf98

There is a potential vulnerability in Traefik managing HTTP/3 connections.

More details in the CVE-2024-53259.

Patches

Workarounds

No workaround

For more information

If you have any questions or comments about this advisory, please open an issue.

CVE-2025-22868

Summary

We have encountered a security vulnerability being reported by our scanners for Traefik 2.11.22.

https://security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-TRAEFIK33-9403297

Details

It seems to target oauth2/jws library.

PoC

No steps to replicate this vulnerability

Impact

We have a strict control on security and we always try to stay up-to-date with the fixes received for third-party solutions.

Patches

GHSA-5423-jcjm-2gpv

Summary

net/http: request smuggling through invalid chunked data: The net/http package accepts data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permit request smuggling. [CVE-2025-22871] Vendor Affected Components: Go: 1.23.x < 1.23.8

More Details: CVE-2025-22871

Patches

CVE-2025-32431

Impact

There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher.

When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a /../ in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain.

Example

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: my-service
spec:
  routes:
    - match: PathPrefix(‘/service’)
      kind: Rule
      services:
        - name: service-a
          port: 8080
      middlewares:
        - name: my-middleware-a
    - match: PathPrefix(‘/service/sub-path’)
      kind: Rule
      services:
        - name: service-a
          port: 8080

In such a case, the request http://mydomain.example.com/service/sub-path/../other-path will reach the backend my-service-a without operating the middleware my-middleware-a unless the computed path is http://mydomain.example.com/service/other-path and should be computes by the first router (operating my-middleware-a).

Patches

Workaround

Add a PathRegexp rule to the matcher to prevent matching a route with a /../ in the path.

Example:

match: PathPrefix(`/service`) && !PathRegexp(`(?:(/\.\./)+.*)`)

For more information

If you have any questions or comments about this advisory, please open an issue.

CVE-2025-47952

Impact

There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher.

When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a URL encoded string in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain.

Example

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: my-service
spec:
  routes:
    - match: PathPrefix(‘/service’)
      kind: Rule
      services:
        - name: service-a
          port: 8080
      middlewares:
        - name: my-middleware-a
    - match: PathPrefix(‘/service/sub-path’)
      kind: Rule
      services:
        - name: service-a
          port: 8080

In such a case, the request http://mydomain.example.com/service/sub-path/%2e%2e/other-path will reach the backend my-service-a without operating the middleware my-middleware-a unless the computed path is http://mydomain.example.com/service/other-path and should be computes by the first router (operating my-middleware-a).

Patches

For more information

If you have any questions or comments about this advisory, please open an issue.

Original Description

Summary

Path traversal with "/../" using URL encodings ("/%2e%2e") allows for circumventing routing rules.

Details

When having defined a route, you can path traverse using the URL encoded variant of /../ and reach endpoints that are not made publicly available. This issue has been found and fixed earlier with regular /../ and has been fixed in this CVE. This URL encoding trick works around that
https://nvd.nist.gov/vuln/detail/CVE-2025-32431

Simply implementing a check on the URL encoding won't be sufficient as path traversal can take numerous formats. See examples here:
https://book.hacktricks.wiki/en/pentesting-web/file-inclusion/index.html

PoC

Setup a service with two endpoints: "/public" and "/private", which returns a 200 OK for both
Setup a Traefik proxy with a single route which points to the service using path /public

Regular requests to traefik /public will return 200 OK and to /private should return 404 (response by Traefik)
When making a request to /public/%2e%2e/private you should receive a 200 OK.

Impact

Impacts all traefik implementations with path prefix routes that expose only part of the downstream api

Suggestion

Provide configuration property which disables all path traversals. Steps:

Decode URL
Evaluate and construct relative path (do traversal before route evaluation)
Compare relative/evaluated path to configured routes (PathPrefix/pathRegexp)

Release Notes

traefik/traefik (github.com/traefik/traefik/v2)

`v2.11.25`

Compare Source

Important: Please read the migration guide.

CVE's fixed:

CVE-2025-47952 (Advisory GHSA-vrch-868g-9jx5)

Bug fixes:

[k8s/ingress] Fix panic for ingress with backend resource (#11777 by rtribotte)
[server] Normalize request path (#11768 by kevinpollet)

Documentation:

[middleware,k8s] Add multi-tenant TLS guidance to the docs (#11724 by sheddy-traefik)
[service] Add a note about how to disable connection reuse with backends (#11716 by rtribotte)
Fix broken link in documentation (#11761 by sheddy-traefik)
Change version for path sanitization migration guide (#11702 by rtribotte)

Update module github.com/traefik/traefik/v2 to v2.11.25 [SECURITY] #218

Are you sure you want to change the base?

Update module github.com/traefik/traefik/v2 to v2.11.25 [SECURITY] #218

Uh oh!

Conversation

renovate bot commented Dec 2, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

For more information

Summary

Details

PoC

Impact

Patches

Workarounds

For more information

Summary

Details

PoC

Impact

Patches

Summary

Patches

Impact

Example

Patches

Workaround

For more information

Impact

Example

Patches

For more information

Summary

Details

PoC

Impact

Suggestion

Release Notes

v3.3.3 (2025-01-31)

v2.11.20 (2025-01-31)

v2.11.19 (2025-01-29)

v3.3.2 (2025-01-14)

v3.3.1 (2025-01-07)

v3.2.5 (2025-01-07)

v2.11.18 (2025-01-07)

v3.3.0 (2025-01-06)

v3.2.4 (2025-01-06)

v2.11.17 (2025-01-06)

v3.3.0-rc2 (2024-12-20)

v3.3.0-rc1 (2024-12-16)

v3.2.3 (2024-12-16)

v2.11.16 (2024-12-16)

v3.2.2 (2024-12-10)

v2.11.15 (2024-12-06)

v3.2.1 (2024-11-20)

v2.11.14 (2024-11-20)

v3.2.0 (2024-10-28)

v3.1.7 (2024-10-28)

v2.11.13 (2024-10-28)

v3.2.0-rc2 (2024-10-09)

v3.1.6 (2024-10-09)

v2.11.12 (2024-10-09)

v3.2.0-rc1 (2024-10-02)

Configuration

Uh oh!

renovate bot commented Dec 2, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ Artifact update notice

File name: go.mod

Uh oh!

Uh oh!

renovate bot commented Dec 2, 2024 •

edited

Loading

renovate bot commented Dec 2, 2024 •

edited

Loading