CVE-2024-39321: 
NixOS vulnerability analysis and mitigation

A vulnerability in Traefik (CVE-2024-39321) allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses. The vulnerability affects Traefik versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3. This issue was discovered and reported by MWedl (GitHub Advisory).

The vulnerability exploits HTTP/3's early data feature during QUIC 0-RTT handshakes. Attackers can obtain a session ticket from the HTTP/3 server using their real IP address, then prepare a UDP datagram containing a QUIC initial packet with the session ticket and an HTTP/3 request. This prepared datagram can be sent with a spoofed source IP address, bypassing IP validation. The CVSS v3.1 base score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (GitHub Advisory).

The vulnerability allows attackers to bypass IP allow-lists, potentially gaining unauthorized access to protected resources. While attackers cannot receive the server's response (making it a blind attack), they can still send requests with spoofed IP addresses that appear to come from allowed IP ranges. The request size is limited by the network path's MTU (GitHub Advisory).

The vulnerability requires HTTP/3 support to be enabled with 0-RTT early data functionality. Exploitation involves a two-step process: first obtaining a session ticket through a legitimate connection, then using that ticket to send spoofed requests. The attack is limited to requests that can fit in a single UDP datagram (GitHub Advisory).

The vulnerability has been patched in Traefik versions 2.11.6, 3.0.4, and 3.1.0-rc3. Users should upgrade to these versions or later. For those unable to upgrade immediately, there are no known workarounds. It is recommended to implement RFC 8470 and set the Early-Data: 1 header when forwarding early data requests to backend services (GitHub Advisory).