Traefik 2.11.57 → 2.11.58
1 release · 0 breaking changes · 5 security fixes · 5 advisories fixed
5security0breaking0deprecated0feature7fix
Vulnerabilities fixed by this upgrade
- 6.3 GHSA-mhjw-hmjv-p99x Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams
- 6.9 GHSA-2272-4vv8-65ww Negated Host matcher causes a TLS option conflict that disables client-certificate authentication on the excluded host
- 7.0 GHSA-cw35-4q88-3rmp Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another
- 7.0 GHSA-qm9f-w54v-q2qh Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool
- 7.0 GHSA-fh26-gfpp-7xxx snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)
Breaking changes
None in the release notes.
Security changes
- security Advisory GHSA-cw35-4q88-3rmp in 2.11.58
- security Advisory GHSA-fh26-gfpp-7xxx in 2.11.58
- security Advisory GHSA-qm9f-w54v-q2qh in 2.11.58
- security Advisory GHSA-2272-4vv8-65ww in 2.11.58
- security Advisory GHSA-mhjw-hmjv-p99x in 2.11.58
Every release in between
securityAdvisory GHSA-cw35-4q88-3rmp
securityAdvisory GHSA-fh26-gfpp-7xxx
securityAdvisory GHSA-qm9f-w54v-q2qh
securityAdvisory GHSA-2272-4vv8-65ww
securityAdvisory GHSA-mhjw-hmjv-p99x
fix[docker] Bump github.com/docker/cli to v29.8.1 ( @kevinpollet)
fix[rules] Ignore negated matchers when parsing rule domains ( @rtribotte)
fix[server] Bump golang.org/x/crypto to v0.57.0 ( @kevinpollet)
fix[server] Ensure that the request TLS state is always set ( @rtribotte)
fix[service] Dedicate a sticky transport per ServersTransport ( @sdelicata)
fix[service] Isolate preauthenticated NTLM and Kerberos backend connections ( @kevinpollet)
fix[udp] Copy UDP datagrams into right-sized buffers before queuing ( @rtribotte)