Traefik 3.7.14 → 3.7.16
2 releases · 1 breaking change · 1 security fix · 4 advisories fixed
1security1breaking0deprecated1feature14fix
Vulnerabilities fixed by this upgrade
- 7.0 GHSA-hrpp-p4fc-wwf8 ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
- 2.1 GHSA-28hp-c82p-8vqj Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret
- 8.2 GHSA-ww7c-q3mv-xx22 Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process
- 7.0 GHSA-p8wx-ph99-xgcr ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation
Breaking changes
- breaking Remove redundant period in README ( @mxmrnn) in 3.7.15
Security changes
- security [security] Fix typo in the Request Path page ( @SethFalco) in 3.7.15
Every release in between
fix[authentication, service, k8s/ingress-nginx] Support NTLM and Kerberos in ForwardAuth and ingress-nginx auth-url ( @juliens)
fix[authentication, service] Support NTLM and Kerberos authentication in ForwardAuth ( @juliens)
fix[k8s/gatewayapi] Fix Gateway API conformance suite setup with the containerd image store ( @Neffi42)
other[k8s/ingress-nginx] Document that rewrite is supported in configuration-snippet ( @bingtang9)
fix[server] Reject CONNECT requests regardless of HTTP version ( @juliens)
fix[server] Reject CONNECT method before reaching the muxer ( @juliens)
fix[k8s/crd] Allow observability metadata on child routers ( @bunnysayzz)
fix[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.3 ( @rtribotte)
fix[k8s/gatewayapi] Default HTTPRoute backend scheme to HTTP when no appProtocol ( @Tyagiquamar)
fix[k8s/ingress-nginx] Apply auth-tls client authentication to the whole host ( @juliens)
fix[k8s/ingress-nginx] Fix cross-namespace check on shared auth-tls-secret TLS options ( @juliens)
fix[fastproxy] Add a non-regression test for CR/LF in FastProxy request headers ( @mturac)
fix[fastproxy] Fix concurrent buffer reads on upgraded connections ( @juliens)
fixBump golang.org/x/net to v0.60.0 ( @kevinpollet)
security[security] Fix typo in the Request Path page ( @SethFalco)
other[k8s/crd] Fix broken Kubernetes CRD definitions links in CRD reference pages ( @SatvikMishra08)
other[k8s] Document the safeNaming impact on cross-provider references ( @lazerg)
other[k8s/gatewayapi] Fix broken links in the Gateway API routing page ( @Neffi42)
fixFix broken anchor links to Restrict the Scope of Service Discovery ( @SatvikMishra08)
featureAdd the documentation style guide to the Contributing section ( @rachana5)
breakingRemove redundant period in README ( @mxmrnn)