ALT-PU-2024-16595-2
Closed vulnerabilities
BDU:2024-04486
Уязвимость компонента net-netip языка программирования Golang, связанная с неправильным контролем доступа, позволяющая нарушителю обойти существующую политику ограничения доступа
BDU:2024-04789
Уязвимость компонентов DefaultAzureCredential и ManagedIdentityCredential библиотек аутентификации Azure Identity Libraries и Microsoft Authentication Library, позволяющая нарушителю повысить свои привилегии
BDU:2024-07712
Уязвимость обратного прокси сервера Containous Traefik, связанная с недостаточной проверкой подлинности данных, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2024-24790
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
- http://www.openwall.com/lists/oss-security/2024/06/04/1
- http://www.openwall.com/lists/oss-security/2024/06/04/1
- https://go.dev/cl/590316
- https://go.dev/cl/590316
- https://go.dev/issue/67680
- https://go.dev/issue/67680
- https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ
- https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ
- https://pkg.go.dev/vuln/GO-2024-2887
- https://pkg.go.dev/vuln/GO-2024-2887
- https://security.netapp.com/advisory/ntap-20240905-0002/
Modified: 2024-11-21
CVE-2024-35255
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Modified: 2024-11-21
CVE-2024-39321
Traefik is an HTTP reverse proxy and load balancer. Versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 have a vulnerability that allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses. Versions 2.11.6, 3.0.4, and 3.1.0-rc3 contain a patch for this issue. No known workarounds are available.
- https://github.com/traefik/traefik/releases/tag/v2.11.6
- https://github.com/traefik/traefik/releases/tag/v2.11.6
- https://github.com/traefik/traefik/releases/tag/v3.0.4
- https://github.com/traefik/traefik/releases/tag/v3.0.4
- https://github.com/traefik/traefik/releases/tag/v3.1.0-rc3
- https://github.com/traefik/traefik/releases/tag/v3.1.0-rc3
- https://github.com/traefik/traefik/security/advisories/GHSA-gxrv-wf35-62w9
- https://github.com/traefik/traefik/security/advisories/GHSA-gxrv-wf35-62w9
Modified: 2024-09-25
CVE-2024-45410
Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise, if they can be modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been addressed in release versions 2.11.9 and 3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-52003
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.