{"id":"CVE-2022-46153","aliases":["GHSA-468w-8x39-gj5v","GO-2022-1152"],"url":"https://o3.security/vulnerability/CVE-2022-46153","summary":"Routes exposed with an empty TLSOption in traefik","details":"## Impact\n\nThere is a potential vulnerability in Traefik managing the TLS connections.\n\nA router configured with a not well-formatted [TLSOption](https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options) is exposed with an empty TLSOption.\n\nFor instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates.\n\n## Patches\n\nhttps://github.com/traefik/traefik/releases/tag/v2.9.6\n\n## Workarounds\n\nCheck the logs to detect the following error messages and fix your TLS options:\n\n- Empty CA:\n\n```\n{\"level\":\"error\",\"msg\":\"invalid clientAuthType: RequireAndVerifyClientCert, CAFiles is required\",\"routerName\":\"Router0@file\"}\n```\n\n- Bad CA content (or bad path):\n\n```\n{\"level\":\"error\",\"msg\":\"invalid certificate(s) content\",\"routerName\":\"Router0@file\"}\n```\n\n- Unknown Client Auth Type:\n\n```\n{\"level\":\"error\",\"msg\":\"unknown client auth type \\\"FooClientAuthType\\\"\",\"routerName\":\"Router0@file\"}\n```\n\n- Invalid cipherSuites\n\n```\n{\"level\":\"error\",\"msg\":\"invalid CipherSuite: foobar\",\"routerName\":\"Router0@file\"}\n```\n\n- Invalid curvePreferences\n\n```\n{\"level\":\"error\",\"msg\":\"invalid CurveID in curvePreferences: foobar\",\"routerName\":\"Router0@file\"}\n``` \n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","published":"2022-12-08T21:46:22.054Z","modified":"2026-10-28T02:30:53.812844514Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/traefik/traefik/v2","fixedVersion":"2.9.6"}],"fix":{"url":"https://github.com/traefik/traefik/commit/7e3fe48b80083b41e9ff82a474a36484cabc701a","label":"traefik/traefik@7e3fe48"},"references":[{"type":"WEB","url":"https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options"},{"type":"WEB","url":"https://github.com/traefik/traefik/releases/tag/v2.9.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46153.json"},{"type":"ADVISORY","url":"https://github.com/traefik/traefik/security/advisories/GHSA-468w-8x39-gj5v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46153"},{"type":"FIX","url":"https://github.com/traefik/traefik/commit/7e3fe48b80083b41e9ff82a474a36484cabc701a"},{"type":"PACKAGE","url":"https://github.com/traefik/traefik"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:53.812844514Z"}}