FreshPorts - VuXML

The Go project reports:

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

< 2.9.8

The traefik project reports:

Update of dependency to go go1.12.8 resolves potential HTTP/2 denial of service in traefik.

< 1.7.14

The traefik authors report:

There is a vulnerability in GO managing HTTP/2 requests, which impacts Traefik. This vulnerability could be exploited to cause a denial of service.

< 2.10.5

The Traefik project reports:

This update is recommended for all traefik users and provides following important security fixes:

• CVE-2022-23469: Authorization header displayed in the debug logs
• CVE-2022-46153: Routes exposed with an empty TLSOption in traefik

< 2.9.6

The Go project reports:

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.

< 2.9.9_1