A 9.8 critical arbitrary execution vulnerability via http requests on Traefik? You'd think we had figured out how to reply to http requests by now
@rune I'm not sure where the 'arbitrary execution' part is coming from, as far as I can tell it's "just" header manipulation?
@joepie91 that's what cert.europa.eu says in their summary
@rune Yeah, agreed. But I can't find anything in either the NIST *or* original advisory suggesting it is anything more than that, other than a vague "things might be worse if the server trusts the header"?
@joepie91 yeah, it's either really poorly described or really poorly graded
@joepie91 9.8 cve score seems quite high for header manipulation