Vulnerability in Oracle Communications Unified Inventory Management
CVE-2022-23632
Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.6.1, Traefik skips the router transport layer security (TLS) configuration when the host header is a fully qualified domain name (FQDN). For a request, the TLS configuration choice can be different than the router choice, which implies the use of a wrong TLS configuration. When sending a request using FQDN handled by a router configured with a dedicated TLS configuration, the TLS configuration falls back to the default configuration that might not correspond to the configured one. If the CNAME flattening is enabled, the selected TLS configuration is the SNI one and the routing uses the CNAME value, so this can skip the expected TLS configuration. Version 2.6.1 contains a patch for this issue. As a workaround, one may add the FDQN to the host rule. However, there is no workaround if the CNAME flattening is enabled.
Vulnerability class: Improper Certificate Validation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.017 (76.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 76th percentile — 76.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: 0.000
Affected products
- Oracle Communications Unified Inventory Management — versions 7.5.0
- Traefik — versions < 2.6.1
Weakness classification (CWE)
References
- github.com/traefik/traefik/security/advisories/GHSA-hrhx-6h34-j5hc (Patch, Third Party Advisory)
- github.com/traefik/traefik/pull/8764 (Patch, Third Party Advisory, Issue Tracking)
- github.com/traefik/traefik/releases/tag/v2.6.1 (Third Party Advisory, Release Notes)
- www.oracle.com/security-alerts/cpujul2022.html (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-23632?
- CVE-2022-23632 is a high-severity vulnerability in Oracle Communications Unified Inventory Management, classified under Improper Certificate Validation. CVSS score: 7.4/10. Published 2022-02-17.
- How severe is CVE-2022-23632?
- High severity. CVSS v3 base score is 7.4 out of 10.