diff options
| author | Thomas Zander <riggs@FreeBSD.org> | 2025-05-30 00:18:16 +0200 |
|---|---|---|
| committer | Thomas Zander <riggs@FreeBSD.org> | 2025-05-30 00:46:18 +0200 |
| commit | 5796456d1d9b3a0bc98ed30f6ececa614ce2b50d (patch) | |
| tree | f392d5d25ec5951bb0a8a727e0eb02dc073c5430 | |
| parent | net/traefik: Update to upstream release 3.4.1 (diff) | |
security/vuxml: Document vulnerability in net/traefik
| -rw-r--r-- | security/vuxml/vuln/2025.xml | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index f810911a2501..9e1a899df898 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,3 +1,33 @@ + <vuln vid="67dd7a9e-3cd8-11f0-b601-5404a68ad561"> + <topic>traefik -- Path traversal vulnerability</topic> + <affects> + <package> + <name>traefik</name> + <range><lt>3.4.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The traefik project reports:</p> + <blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-vrch-868g-9jx5"> + <p>There is a potential vulnerability in Traefik managing the requests + using a PathPrefix, Path or PathRegex matcher. When Traefik is configured + to route the requests to a backend using a matcher based on the path, if + the URL contains a URL encoded string in its path, it's possible to target + a backend, exposed using another router, by-passing the middlewares chain.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2025-47952</cvename> + <url>https://nvd.nist.gov/vuln/detail/CVE-2025-47952</url> + </references> + <dates> + <discovery>2025-05-27</discovery> + <entry>2025-05-29</entry> + </dates> + </vuln> + <vuln vid="c36decbe-3c84-11f0-8d29-b42e991fc52e"> <topic>glpi-project -- GLPI multiple vulnerabilities</topic> <affects> |