GHSA-f7cq-5v43-8pwp Traefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop

Not scored Published 23 May 2024

Traefik is vulnerable to a denial of service attack via malformed DNS messages, requiring an upgrade to patched versions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-f7cq-5v43-8pwp?

GHSA-f7cq-5v43-8pwp is a denial of service vulnerability in github.com/traefik/traefik, published on 23 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Impact

There is a vulnerability in GO managing malformed DNS message, which impacts Traefik. This vulnerability could be exploited to cause a denial of service.

References

CVE-2024-24788

Patches

Workarounds

No workaround.

For more information

If you have any questions or comments about this advisory, please open an issue.

Which versions are affected by GHSA-f7cq-5v43-8pwp?

9 open source packages ship an affected version, including github.com/traefik/traefik, github.com/traefik/traefik/v2 and github.com/traefik/traefik/v3.

Package	Affected	Fixed in
`github.com/traefik/traefik` Go	All versions	None
`github.com/traefik/traefik` Go	All versions to `1.7.34`	None
`github.com/traefik/traefik` Go	All versions to `1.7.34`	None
`github.com/traefik/traefik/v2` Go	All versions	`2.11.3`
`github.com/traefik/traefik/v2` Go	All versions	`2.11.3`
`github.com/traefik/traefik/v2` Go	All versions	`2.11.3`

3 more packages

`github.com/traefik/traefik/v3` Go	All versions	`3.0.1`
`github.com/traefik/traefik/v3` Go	All versions	`3.0.1`
`github.com/traefik/traefik/v3` Go	All versions	`3.0.1`

How do I fix GHSA-f7cq-5v43-8pwp?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is GHSA-f7cq-5v43-8pwp being exploited?

There is no known exploitation of GHSA-f7cq-5v43-8pwp in the wild and no public exploit code.

Sources

Also known as GO-2024-2880.