Improper Resource Locking in Traefik - CVE-2023-47124
Published: December 4, 2023
Vulnerability identifier: #VU83636
CSH Severity: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-47124
CWE-ID: CWE-413
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Traefik
Traefik
Software vendor:
Containous
Containous
Description
The vulnerability allows a remote attacker to perform a denial of service attack.
The
vulnerability exists due to the way the application handles ACME HTTP challenge. If Traefik is configured to use the HTTPChallenge to generate and renew the Let's Encrypt TLS certificates, the delay authorized to solve the challenge of 50 seconds can be exploited by perform a slowloris attack.
Remediation
Install updates from vendor's website.