x/vulndb: potential Go vuln in github.com/traefik/traefik: CVE-2023-29013

[GoVulnBot]

CVE-2023-29013 references github.com/traefik/traefik, which may be a Go module.

Description:
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. This issue has been patched in versions 2.9.10 and 2.10.0-rc2.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-29013
• JSON: https://github.com/CVEProject/cvelist/tree/af4bc61c0e6576b31cc38888bc9c6c30d47489c3/2023/29xxx/CVE-2023-29013.json
• advisory: GHSA-7hj9-rv74-5g92
• fix: traefik/traefik@4ed3964
• web: https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2
• web: https://github.com/traefik/traefik/releases/tag/v2.9.10
• Imported by: https://pkg.go.dev/github.com/traefik/traefik?tab=importedby

Cross references:

• Module github.com/traefik/traefik appears in issue x/vulndb: potential Go vuln in github.com/traefik/traefik: CVE-2022-23632 #325 EFFECTIVELY_PRIVATE
• Module github.com/traefik/traefik appears in issue x/vulndb: potential Go vuln in github.com/traefik/traefik: GHSA-7h6j-2268-fhcm #808 NOT_IMPORTABLE
• Module github.com/traefik/traefik appears in issue x/vulndb: potential Go vuln in github.com/traefik/traefik: CVE-2021-32813, GHSA-m697-4v8f-55qg #923 NOT_IMPORTABLE
• CVE-2023-29013 appears in issue x/vulndb: potential Go vuln in github.com/traefik/traefik/v2: GHSA-7hj9-rv74-5g92 #1715 DEPENDENT_VULNERABILITY

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/traefik/traefik
    packages:
      - package: traefik
description: |+
    Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer for deploying microservices. There is a vulnerability in Go when parsing the HTTP headers, which impacts Traefik. HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service. This issue has been patched in versions 2.9.10 and 2.10.0-rc2.

cves:
  - CVE-2023-29013
references:
  - advisory: https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92
  - fix: https://github.com/traefik/traefik/commit/4ed3964b3586565519249bbdc55eb1b961c08c49
  - web: https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2
  - web: https://github.com/traefik/traefik/releases/tag/v2.9.10

[timothy-king]

Duplicate of #1715