Traefik 3.7.13 → 3.7.17

Vulnerabilities fixed by this upgrade

• 7.0 GHSA-hrpp-p4fc-wwf8 ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
• 2.1 GHSA-28hp-c82p-8vqj Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret
• 8.2 GHSA-ww7c-q3mv-xx22 Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process
• 7.0 GHSA-p8wx-ph99-xgcr ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation
• 6.3 GHSA-mhjw-hmjv-p99x Unsynchronized write to the per-connection sticky round tripper shared by concurrent HTTP/2 streams
• 7.0 GHSA-rv2h-qh7j-xrjw Ingress-NGINX provider: colliding auth-tls-secret names merge two client CAs into one TLS option, so a host is gated by another host's CA
• 7.0 GHSA-qvj7-gq9c-hp7q Kubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without auth
• 7.0 GHSA-mwrr-6hp4-pxr6 Ingress-NGINX provider forwards forged Ssl-Client-* identity headers on its HTTP route
• 7.0 GHSA-53qr-784g-cj35 FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients
• 7.0 GHSA-cw35-4q88-3rmp Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another
• 7.0 GHSA-qm9f-w54v-q2qh Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool
• 7.0 GHSA-fh26-gfpp-7xxx snicheck skips the check when `req.TLS` is nil (HTTP/2 `:scheme http`)

Breaking changes

• breaking Remove redundant period in README ( @mxmrnn) in 3.7.15

Security changes

• security [security] Point security announcements to GitHub advisories ( @nmengin) in 3.7.17
• security Advisory GHSA-hrpp-p4fc-wwf8 in 3.7.16
• security Advisory GHSA-p8wx-ph99-xgcr in 3.7.15
• security Advisory GHSA-ww7c-q3mv-xx22 in 3.7.15
• security Advisory GHSA-28hp-c82p-8vqj in 3.7.15
• security [security] Fix typo in the Request Path page ( @SethFalco) in 3.7.15
• security Advisory GHSA-53qr-784g-cj35 in 3.7.14
• security Advisory GHSA-cw35-4q88-3rmp in 3.7.14
• security Advisory GHSA-fh26-gfpp-7xxx in 3.7.14
• security Advisory GHSA-mwrr-6hp4-pxr6 in 3.7.14
• security Advisory GHSA-qm9f-w54v-q2qh in 3.7.14
• security Advisory GHSA-qvj7-gq9c-hp7q in 3.7.14
• security Advisory GHSA-rv2h-qh7j-xrjw in 3.7.14
• security Advisory GHSA-mhjw-hmjv-p99x in 3.7.14
• security [security] Document the coordinated disclosure embargo for security reports ( @emilevauge) in 3.7.14

Every release in between