x/vulndb: potential Go vuln in github.com/traefik/traefik/v2: GHSA-7hj9-rv74-5g92

[GoVulnBot]

In GitHub Security Advisory GHSA-7hj9-rv74-5g92, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/traefik/traefik/v2	2.10.0-rc2	= 2.10.0-rc1

Cross references:

• Module github.com/traefik/traefik/v2 appears in issue x/vulndb: potential Go vuln in github.com/traefik/traefik/v2: GHSA-c6hx-pjc3-7fqr #1057 DEPENDENT_VULNERABILITY
• Module github.com/traefik/traefik/v2 appears in issue x/vulndb: potential Go vuln in github.com/traefik/traefik/v2: GHSA-468w-8x39-gj5v #1152 EFFECTIVELY_PRIVATE
• Module github.com/traefik/traefik/v2 appears in issue x/vulndb: potential Go vuln in github.com/traefik/traefik/v2: GHSA-h2ph-vhm7-g4hp #1154 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/traefik/traefik/v2
    versions:
      - introduced: TODO (earliest fixed "2.10.0-rc2", vuln range "= 2.10.0-rc1")
    packages:
      - package: github.com/traefik/traefik/v2
  - module: github.com/traefik/traefik/v2
    versions:
      - fixed: 2.9.10
    packages:
      - package: github.com/traefik/traefik/v2
summary: 'Traefik HTTP header parsing could cause a denial of service '
description: |
    ### Impact

    There is a vulnerability in [Go when parsing the HTTP headers](https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8/m/OV40vnafAwAJ), which impacts Traefik.
    HTTP header parsing could allocate substantially more memory than required to hold the parsed headers. This behavior could be exploited to cause a denial of service.

    ### References

    - [CVE-2023-24534](https://www.cve.org/CVERecord?id=CVE-2023-24534)

    ### Patches
    - https://github.com/traefik/traefik/releases/tag/v2.9.10
    - https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2

    ### Workarounds

    No workaround.

    ### For more information

    If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).
cves:
  - CVE-2023-29013
ghsas:
  - GHSA-7hj9-rv74-5g92
references:
  - advisory: https://github.com/traefik/traefik/security/advisories/GHSA-7hj9-rv74-5g92
  - fix: https://github.com/traefik/traefik/commit/4ed3964b3586565519249bbdc55eb1b961c08c49
  - advisory: https://github.com/advisories/GHSA-8v5j-pwr7-w5f8
  - web: https://github.com/traefik/traefik/releases/tag/v2.10.0-rc2
  - web: https://github.com/traefik/traefik/releases/tag/v2.9.10
  - web: https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8/m/OV40vnafAwAJ
  - advisory: https://github.com/advisories/GHSA-7hj9-rv74-5g92

[timothy-king]

CVE-2023-24534 is #1704.

[gopherbot]

Change https://go.dev/cl/483776 mentions this issue: data/excluded: batch add GO-2023-1715, GO-2023-1714, GO-2023-1707