CVE-2023-47124

Katalog CVE

CVSS 5.9 · Medium EPSS 0,79%

Kerentanan Missing Release of Resource after Effective Lifetime pada traefik. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

Traefik is an open source HTTP reverse proxy and load balancer. When Traefik is configured to use the `HTTPChallenge` to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers to achieve a `slowloris attack`. This vulnerability has been patch in version 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. Users unable to upgrade should replace the `HTTPChallenge` with the `TLSChallenge` or the `DNSChallenge`.

Rincian

Terbit di NVD

4 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-772: Missing Release of Resource after Effective Lifetime

EPSS (30 hari)

0,79% peluang dieksploitasi; lebih tinggi dari 55,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traefik/traefik/security/advisories/GHSA-8g85-whqh-cr2f advisory pihak ketiga
• https://doc.traefik.io/traefik/https/acme/#dnschallenge product
• https://doc.traefik.io/traefik/https/acme/#httpchallenge product
• https://doc.traefik.io/traefik/https/acme/#tlschallenge product
• https://github.com/traefik/traefik/releases/tag/v2.10.6 release notes
• https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5 release notes
• https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris