« Volver al listado

CVE-2024-39321

Estado: AnalizadaAlta (7.5)—

Traefik is an HTTP reverse proxy and load balancer. Versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 have a vulnerability that allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses. Versions 2.11.6, 3.0.4, and 3.1.0-rc3 contain a patch for this issue. No known workarounds are available.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Traefik — Traefik

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-39321",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-39321",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-05T20:07:02.660742Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "traefik",
          "product": "traefik",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.11.6"
            },
            {
              "status": "affected",
              "version": ">= 3.0.0-beta3, < 3.0.4"
            },
            {
              "status": "affected",
              "version": ">= 3.1.0-rc1, < 3.1.0-rc3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-07-05T18:15:32.430",
  "references": [
    {
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.6",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/traefik/traefik/releases/tag/v3.0.4",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/traefik/traefik/releases/tag/v3.1.0-rc3",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-gxrv-wf35-62w9",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.6",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/traefik/traefik/releases/tag/v3.0.4",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/traefik/traefik/releases/tag/v3.1.0-rc3",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-gxrv-wf35-62w9",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Traefik is an HTTP reverse proxy and load balancer. Versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 have a vulnerability that allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses. Versions 2.11.6, 3.0.4, and 3.1.0-rc3 contain a patch for this issue. No known workarounds are available."
    },
    {
      "lang": "es",
      "value": "Traefik es un proxy inverso HTTP y un equilibrador de carga. Las versiones anteriores a 2.11.6, 3.0.4 y 3.1.0-rc3 tienen una vulnerabilidad que permite eludir las listas de direcciones IP permitidas a través de solicitudes de datos tempranas HTTP/3 en protocolos de enlace QUIC 0-RTT enviados con direcciones IP falsificadas. Las versiones 2.11.6, 3.0.4 y 3.1.0-rc3 contienen un parche para este problema. No hay soluciones conocidas disponibles."
    }
  ],
  "lastModified": "2026-06-17T07:41:42.670",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9D1F5C0-4B9B-4F4A-B8EC-CEE987D7CE06",
              "versionEndExcluding": "2.11.6"
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FC9E015-376F-4323-8493-1067B1E506DC",
              "versionEndExcluding": "3.0.4",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.1.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26F0E6E9-13E6-4CEC-AC68-82DFF86AB3AC"
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.1.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "807C986B-A9D5-4516-BE4C-37AF99257592"
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:3.1.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CF1490E-811C-4531-A02A-1D189EDF0D5A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}