Input validation error in Traefik - CVE-2023-29013
Published: April 10, 2023 / Updated: April 11, 2023
Vulnerability identifier: #VU74624
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-29013
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when parsing HTTP and MIME headers. A remote attacker can cause an HTTP server to allocate large amounts of memory from a small request and perform a denial of service (DoS) attack.
Affected software
Traefik
IBM Robotic Process Automation
IBM Cloud Pak for Watson AIOps
Robotic Process Automation for Cloud Pak
IBM Robotic Process Automation
IBM Cloud Pak for Watson AIOps
Robotic Process Automation for Cloud Pak
How to mitigate CVE-2023-29013
Install updates from vendor's website.
Traefik - update to 2.9.10
IBM Cloud Pak for Watson AIOps - update to 3.7.2
IBM Robotic Process Automation - addressed in versions 21.0.7.8, 23.0.9
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.8, 23.0.9
IBM Cloud Pak for Watson AIOps - update to 3.7.2
IBM Robotic Process Automation - addressed in versions 21.0.7.8, 23.0.9
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.8, 23.0.9