Does settings a readTimeout to 0 still protect us against CVE-2024-28869? about traefik HOT 5 CLOSED

Hello @gabfv and thanks for your interest in Traefik,

Setting the readTimeout value to 0, disables the timeout which makes Traefik vulnerable to CVE-2024-28869

from traefik.

Is that also true for TCP? The CVE doesn't mention it.

Asking since a have a rsync server here which fails randomly since the last traefik update.

from traefik.

Looks like the restic rest server has the same issue now...

from traefik.

@lazka The fix for CVE-2024-28869 has been to set a non-default value (60s) for the readTimeout option, also applied during the first bytes read operations in Traefik to manage layer 4 routing. So yes, Traefik won't block indefinitely for the first bytes (e.g.: client hello).

from traefik.

Thanks, but I was referring to the initial question, if setting it to 0 for TCP makes it a DoS vector.

from traefik.