CVE-2021-32813

CVE-2021-32813 · Drop Headers via Malicious Connection Header

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.4.13, there exists a potential header vulnerability in Traefik's handling of the Connection header. Active exploitation of this issue is unlikely, as it requires that a removed header would lead to a privilege escalation, however, the Traefik team has addressed this issue to prevent any potential abuse. If one has a chain of Traefik middlewares, and one of them sets a request header, then sending a request with a certain Connection header will cause it to be removed before the request is sent. In this case, the backend does not see the request header. A patch is available in version 2.4.13. There are no known workarounds aside from upgrading.

CVSS 4.8 · Media · EPSS 1,1%

Publicación

2021-08-03T22:50:11.000Z

Actualización

2024-08-03T23:33:55.883Z

Pila tecnológica: web

Comprueba tu servidor →