CVE-2022-46153
published 2022-12-08CVE-2022-46153: Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential vulnerability in Traefik managing TLS connections. A…
PriorityP336medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.49%
38.3th percentile
Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential vulnerability in Traefik managing TLS connections. A router configured with a not well-formatted TLSOption is exposed with an empty TLSOption. For instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates. Users are advised to upgrade to version 2.9.6. Users unable to upgrade should check their logs to detect the error messages and fix your TLS options.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | traefik_traefik_v2 | >= 0 < 2.9.6 | 2.9.6 |
| traefik | traefik | < 2.9.6 | 2.9.6 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vendor_oracle6.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Traefik routes exposed with an empty TLSOption in github.com/traefik/traefik
osv·2024-08-21
CVE-2022-46153 Traefik routes exposed with an empty TLSOption in github.com/traefik/traefik
Traefik routes exposed with an empty TLSOption in github.com/traefik/traefik
Traefik routes exposed with an empty TLSOption in github.com/traefik/traefik
GHSA
Traefik routes exposed with an empty TLSOption
ghsa·2022-12-08
CVE-2022-46153 [MEDIUM] CWE-295 Traefik routes exposed with an empty TLSOption
Traefik routes exposed with an empty TLSOption
## Impact
There is a potential vulnerability in Traefik managing the TLS connections.
A router configured with a not well-formatted [TLSOption](https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options) is exposed with an empty TLSOption.
For instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates.
## Patches
https://github.com/traefik/traefik/releases/tag/v2.9.6
## Workarounds
Check the logs to detect the following error messages and fix your TLS options:
- Empty CA:
```
{"level":"error","msg":"invalid clientAuthType: RequireAndVerifyClientCert, CAFiles is required","routerName":"Router0@file"}
```
- Bad CA content (or bad path):
```
{"level":"error","msg":"
OSV
Traefik routes exposed with an empty TLSOption
osv·2022-12-08
CVE-2022-46153 [MEDIUM] Traefik routes exposed with an empty TLSOption
Traefik routes exposed with an empty TLSOption
## Impact
There is a potential vulnerability in Traefik managing the TLS connections.
A router configured with a not well-formatted [TLSOption](https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options) is exposed with an empty TLSOption.
For instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates.
## Patches
https://github.com/traefik/traefik/releases/tag/v2.9.6
## Workarounds
Check the logs to detect the following error messages and fix your TLS options:
- Empty CA:
```
{"level":"error","msg":"invalid clientAuthType: RequireAndVerifyClientCert, CAFiles is required","routerName":"Router0@file"}
```
- Bad CA content (or bad path):
```
{"level":"error","msg":"
Oracle
Oracle Oracle Communications Applications Risk Matrix: Security (Traefik) — CVE-2022-46153
vendor_oracle·2023-07-15·CVSS 6.5
CVE-2022-46153 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Security (Traefik) — CVE-2022-46153
Oracle Oracle Communications Applications Risk Matrix: Security (Traefik) vulnerability
CVE: CVE-2022-46153
CVSS: 6.5
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://doc.traefik.io/traefik/v2.9/https/tls/#tls-optionshttps://github.com/traefik/traefik/commit/7e3fe48b80083b41e9ff82a474a36484cabc701ahttps://github.com/traefik/traefik/releases/tag/v2.9.6https://github.com/traefik/traefik/security/advisories/GHSA-468w-8x39-gj5vhttps://doc.traefik.io/traefik/v2.9/https/tls/#tls-optionshttps://github.com/traefik/traefik/commit/7e3fe48b80083b41e9ff82a474a36484cabc701ahttps://github.com/traefik/traefik/releases/tag/v2.9.6https://github.com/traefik/traefik/security/advisories/GHSA-468w-8x39-gj5v
2022-12-08
Published