GHSA-2cjc-rgmp-x649

Traefik Missing Authentication

Source: GitHub Advisory Database (reviewed) High CVE-2018-15598

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/traefik/traefik	>= 1.6.0, < 1.6.6	1.6.6

Details

As written in the advisory (Markdown source, shown as plain text).

Containous Traefik 1.6.x before 1.6.6, when `--api` is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-15598 advisory
https://github.com/containous/traefik/pull/3790 web
https://github.com/containous/traefik/commit/113250ce5735d554c502ca16fb03bb9119ca79f1 web
https://github.com/containous/traefik/commit/368bd170913078732bde58160f92f202f370278b web
https://github.com/containous/traefik package
https://github.com/containous/traefik/releases/tag/v1.6.6 web