Traefik 3.7.14 → 3.7.17
3 releases · 1 breaking change · 6 security fixes · 4 advisories fixed
6security1breaking0deprecated1feature28fix
Vulnerabilities fixed by this upgrade
- 7.0 GHSA-hrpp-p4fc-wwf8 ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients
- 2.1 GHSA-28hp-c82p-8vqj Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret
- 8.2 GHSA-ww7c-q3mv-xx22 Data race on the shared bufio.Reader after an HTTP/1 upgrade in FastProxy panics the whole process
- 7.0 GHSA-p8wx-ph99-xgcr ingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotation
Breaking changes
- breaking Remove redundant period in README ( @mxmrnn) in 3.7.15
Security changes
- security [security] Point security announcements to GitHub advisories ( @nmengin) in 3.7.17
- security Advisory GHSA-hrpp-p4fc-wwf8 in 3.7.16
- security Advisory GHSA-p8wx-ph99-xgcr in 3.7.15
- security Advisory GHSA-ww7c-q3mv-xx22 in 3.7.15
- security Advisory GHSA-28hp-c82p-8vqj in 3.7.15
- security [security] Fix typo in the Request Path page ( @SethFalco) in 3.7.15
Every release in between
fix[acme] Bump github.com/go-acme/lego/v5 to v5.6.0 ( @ldez)
fix[acme] Bump github.com/go-jose/go-jose/v4 to v4.1.6 ( @Mheaus)
fix[http3] Bump github.com/quic-go/quic-go to v0.64.1 ( @janpachol)
fix[k8s/gatewayapi] Preserve Gateway status conditions owned by other controllers ( @Neffi42)
fix[k8s/ingress-nginx] Avoid generated name collisions across namespaces in the ingress-nginx provider ( @Neffi42)
fix[logs, k8s/gatewayapi] Lower user configuration error logs to debug ( @rtribotte)
fix[middleware] Bump github.com/andybalholm/brotli to v1.2.7 ( @albe2669)
fix[middleware] Fix broken flush, hijack, and deadlines in wrapped ResponseWriters ( @Neffi42)
fix[middleware, authentication, k8s/crd, k8s, k8s/ingress-nginx] Resolve secret references when building middlewares ( @sdelicata)
fix[server] Add an entry point option to limit the number of request header values ( @juliens)
fix[server] Add global default for aliasHeadersStrategy ( @nikolas-sapa)
fix[server] Bump golang.org/x/net to v0.62.0 ( @kevinpollet)
fix[server] Fix backend connection leak for NTLM and Kerberos authentication ( @juliens)
fix[server, fastproxy] Fix FastProxy backend connection leak for NTLM and Kerberos ( @juliens)
other[docker] Update Docker Basic guide to use Traefik v3.7 ( @Saku0512)
security[security] Point security announcements to GitHub advisories ( @nmengin)
securityAdvisory GHSA-hrpp-p4fc-wwf8
fix[authentication, service, k8s/ingress-nginx] Support NTLM and Kerberos in ForwardAuth and ingress-nginx auth-url ( @juliens)
fix[authentication, service] Support NTLM and Kerberos authentication in ForwardAuth ( @juliens)
fix[k8s/gatewayapi] Fix Gateway API conformance suite setup with the containerd image store ( @Neffi42)
other[k8s/ingress-nginx] Document that rewrite is supported in configuration-snippet ( @bingtang9)
securityAdvisory GHSA-p8wx-ph99-xgcr
securityAdvisory GHSA-ww7c-q3mv-xx22
securityAdvisory GHSA-28hp-c82p-8vqj
fix[server] Reject CONNECT requests regardless of HTTP version ( @juliens)
fix[server] Reject CONNECT method before reaching the muxer ( @juliens)
fix[k8s/crd] Allow observability metadata on child routers ( @bunnysayzz)
fix[k8s/gatewayapi] Bump sigs.k8s.io/gateway-api to v1.6.3 ( @rtribotte)
fix[k8s/gatewayapi] Default HTTPRoute backend scheme to HTTP when no appProtocol ( @Tyagiquamar)
fix[k8s/ingress-nginx] Apply auth-tls client authentication to the whole host ( @juliens)
fix[k8s/ingress-nginx] Fix cross-namespace check on shared auth-tls-secret TLS options ( @juliens)
fix[fastproxy] Add a non-regression test for CR/LF in FastProxy request headers ( @mturac)
fix[fastproxy] Fix concurrent buffer reads on upgraded connections ( @juliens)
fixBump golang.org/x/net to v0.60.0 ( @kevinpollet)
security[security] Fix typo in the Request Path page ( @SethFalco)
other[k8s/crd] Fix broken Kubernetes CRD definitions links in CRD reference pages ( @SatvikMishra08)
other[k8s] Document the safeNaming impact on cross-provider references ( @lazerg)
other[k8s/gatewayapi] Fix broken links in the Gateway API routing page ( @Neffi42)
fixFix broken anchor links to Restrict the Scope of Service Discovery ( @SatvikMishra08)
featureAdd the documentation style guide to the Contributing section ( @rachana5)
breakingRemove redundant period in README ( @mxmrnn)