{"schema_version":"1.7.3","id":"GHSA-468w-8x39-gj5v","published":"2022-12-08T16:11:12Z","modified":"2026-08-07T08:12:19.661240110Z","aliases":["CVE-2022-46153","GO-2022-1152"],"summary":"Traefik routes exposed with an empty TLSOption","details":"## Impact\n\nThere is a potential vulnerability in Traefik managing the TLS connections.\n\nA router configured with a not well-formatted [TLSOption](https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options) is exposed with an empty TLSOption.\n\nFor instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates.\n\n## Patches\n\nhttps://github.com/traefik/traefik/releases/tag/v2.9.6\n\n## Workarounds\n\nCheck the logs to detect the following error messages and fix your TLS options:\n\n- Empty CA:\n\n```\n{\"level\":\"error\",\"msg\":\"invalid clientAuthType: RequireAndVerifyClientCert, CAFiles is required\",\"routerName\":\"Router0@file\"}\n```\n\n- Bad CA content (or bad path):\n\n```\n{\"level\":\"error\",\"msg\":\"invalid certificate(s) content\",\"routerName\":\"Router0@file\"}\n```\n\n- Unknown Client Auth Type:\n\n```\n{\"level\":\"error\",\"msg\":\"unknown client auth type \\\"FooClientAuthType\\\"\",\"routerName\":\"Router0@file\"}\n```\n\n- Invalid cipherSuites\n\n```\n{\"level\":\"error\",\"msg\":\"invalid CipherSuite: foobar\",\"routerName\":\"Router0@file\"}\n```\n\n- Invalid curvePreferences\n\n```\n{\"level\":\"error\",\"msg\":\"invalid CurveID in curvePreferences: foobar\",\"routerName\":\"Router0@file\"}\n``` \n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","affected":[{"package":{"name":"github.com/traefik/traefik/v2","ecosystem":"Go","purl":"pkg:golang/github.com/traefik/traefik/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.9.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-468w-8x39-gj5v/GHSA-468w-8x39-gj5v.json"}}],"references":[{"type":"WEB","url":"https://github.com/traefik/traefik/security/advisories/GHSA-468w-8x39-gj5v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46153"},{"type":"WEB","url":"https://github.com/traefik/traefik/commit/7e3fe48b80083b41e9ff82a474a36484cabc701a"},{"type":"WEB","url":"https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options"},{"type":"PACKAGE","url":"https://github.com/traefik/traefik"},{"type":"WEB","url":"https://github.com/traefik/traefik/releases/tag/v2.9.6"}],"database_specific":{"cwe_ids":["CWE-295"],"github_reviewed":true,"github_reviewed_at":"2022-12-08T16:11:12Z","nvd_published_at":"2022-12-08T22:15:00Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}