traefik: 3.1.2 -> 3.1.4

[Scrumplex]

Description of changes

This fixes CVE-2024-45410[0] (GHSA-62c8-mh53-4cqv[1]).

Closes #344144

Relevant Releases:

https://github.com/traefik/traefik/releases/tag/v3.1.3 (actual vulnerability fix)
https://github.com/traefik/traefik/releases/tag/v3.1.4 (latest release)

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[Scrumplex]

Result of nixpkgs-review pr 344149 run on x86_64-linux 1

1 package built:

• traefik

[Scrumplex]

@ofborg test traefik

[Scrumplex]

CC @NixOS/security

This PR fixes a critical vulnerability in Traefik. See https://nvd.nist.gov/vuln/detail/CVE-2024-45410 GHSA-62c8-mh53-4cqv

[mweinelt]

@Scrumplex Are you planning to apply a patch for NixOS 24.05?

[mweinelt]

By which I mean a patch application should be investigated!

[Scrumplex]

According to GHSA-62c8-mh53-4cqv, any Traefik v3 version before 3.1.3 is affected. As 24.05 is on 3.0.4 it should probably also be updated. I will prepare a PR.

[Scrumplex]

I just noticed that we don't have go_1_23 on 24.05

[mweinelt]

Could be traefik/traefik@5841441

[Scrumplex]

traefik/traefik@5841441 can't be applied onto v3. That change was merged into v2 and then merged into v3 in traefik/traefik@093989f

which is a much larger merge as well.

[mweinelt]

Gross.

[mweinelt]

traefik/traefik@093989f#diff-164089fbccd1553baf9568ff75818f506cc9d96c524d6b9454b672e0f959a33d (pkg/middlewares/forwardedheaders/forwarded_header.go) looks like the relevant bits.

[Scrumplex]

I have prepared Scrumplex/traefik@21f0062 which is traefik/traefik@5841441 but merged into v3.1.2 (the last version before upstream updated to Go 1.23)

What I had to merge:

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   pkg/middlewares/auth/forward.go
	both modified:   pkg/middlewares/forwardedheaders/forwarded_header.go
	both modified:   pkg/middlewares/headers/headers.go

Edit: I corrected the patch just now. I didn't merge one line properly (variable declaration instead of assignment in headers.go)

[Scrumplex]

See #344222