CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-23469 – Authorization header displayed in the debug logs
https://notcve.org/view.php?id=CVE-2022-23469
08 Dec 2022 — Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Authorization header in its debug logs. In certain cases, if the log level is set to DEBUG, credentials provided using the Authorization header are displayed in the debug logs. Attackers must have access to a users logging system in order for credentials to be stolen. This issue has been addressed in version 2.9.6. • https://github.com/traefik/traefik/pull/9574 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-39271 – Traefik HTTP/2 connections management could cause a denial of service
https://notcve.org/view.php?id=CVE-2022-39271
11 Oct 2022 — Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service. There has been a patch released in versions 2.8.8 and 2.9.0-rc5. • https://github.com/traefik/traefik/releases/tag/v2.8.8 • CWE-400: Uncontrolled Resource Consumption CWE-755: Improper Handling of Exceptional Conditions •