CVE-2023-47106 The advisory has been revoked - it doesn't affect any version of package traefik (opens in a new tab)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-WOLFILATEST-TRAEFIK-6097564
- published4 Dec 2023
- disclosed4 Dec 2023
Introduced: 4 Dec 2023
CVE-2023-47106 (opens in a new tab)Amendment
The Wolfi security team deemed this advisory irrelevant for Wolfi:latest.
NVD Description
Note: Versions mentioned in the description apply only to the upstream traefik package and not the traefik package as distributed by Wolfi.
Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability.