Cryptographic issues in Traefik - CVE-2022-23632
Published: July 19, 2022 / Updated: May 5, 2026
Vulnerability identifier: #VU65457
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2022-23632
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to insecure TLS configuration choice when configuring mTLS between Traefik and clients. A remote attacker can force the application to use less secure TLS configuration, that can result in successful man-in-the-middle attacks.
Affected software
Traefik
Oracle Communications Unified Inventory Management
Oracle Communications Order and Service Management
Oracle Communications Unified Inventory Management
Oracle Communications Order and Service Management
How to mitigate CVE-2022-23632
Install updates from vendor's website.
Traefik - update to 2.6.1