Improper Certificate Validation Affecting github.com/traefik/traefik/v2/integration package, versions <2.9.6


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.11% (46th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-GOLANG-GITHUBCOMTRAEFIKTRAEFIKV2INTEGRATION-3166279
  • published9 Dec 2022
  • disclosed9 Dec 2022
  • creditUnknown

Introduced: 9 Dec 2022

CVE-2022-46153  (opens in a new tab)
CWE-295  (opens in a new tab)

How to fix?

Upgrade github.com/traefik/traefik/v2/integration to version 2.9.6 or higher.

Overview

Affected versions of this package are vulnerable to Improper Certificate Validation such that a router configured with a not well-formatted TLSOption is exposed with an empty TLSOption. For instance, a router secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates.

Workaround

Users unable to upgrade should check their logs to detect the error messages and fix your TLS options.

CVSS Scores

version 3.1