v1.12.2

v1.12.2

Security release. Upgrading is recommended for anyone on v1.12.1 or earlier.

Security

• The ping fallback skipped the address guard (GHSA-fj38-mp6h-6cvv).
  /api/ping validated the address it was given, but the fallback it tried afterwards was only
  checked for an http:// or https:// prefix before being requested. That let an authenticated
  user reach addresses the guard exists to refuse, including link-local ranges such as cloud
  metadata endpoints. The response carries a status code and latency only, no body, so this is a
  blind request rather than a way to read data back. The fallback now passes exactly the same check
  as the primary address.

  Reported by tonghuaroot.

Notes

The same report suggested also refusing loopback and private addresses in general. That is not being
changed: reaching them is what Traefik Manager does. The default Docker configuration points at
http://traefik:8080, which resolves to a private address, the documented Linux install points at
http://localhost:8080, and pinging a route tests your own backends, which are private by
definition. Refusing those would disable the features rather than harden them.