CVE-2019-20894: 
NixOS vulnerability analysis and mitigation

CVE-2019-20894 affects Traefik 2.x, a modern HTTP reverse proxy and load balancer. The vulnerability allows HTTPS sessions to proceed without proper mutual TLS verification in certain configurations where ERR_BAD_SSL_CLIENT_AUTH_CERT should have occurred (Debian Tracker, MITRE CVE).

The vulnerability occurs when Traefik 2.x is configured with mutual TLS (mTLS) verification. In specific scenarios, when a client establishes an HTTPS connection without providing the required client certificates, Traefik fails to properly enforce the mTLS verification requirements. This particularly affects scenarios where multiple services are hosted, some requiring mTLS and others not (GitHub Issue).

When exploited, this vulnerability allows unauthorized clients to access services that should require client certificate authentication. This bypasses the mutual TLS security controls, potentially exposing protected services to unauthorized access (GitHub Issue).

The vulnerability can be triggered when a client first establishes a connection to a non-mTLS protected service and then accesses an mTLS-protected service using the same connection. This behavior has been confirmed in both Chrome and Firefox browsers (GitHub Issue).