Traefik v3.7.13 fixes BasicAuth timing oracle vulnerability

Traefik v3.7.13 addresses a security vulnerability in its BasicAuth middleware, as detailed in a GitHub Security Advisory. The issue, classified as medium severity, involves a username-enumeration timing oracle reintroduced by the singleflight coalescing mechanism. Since v3.6.11, the deduplication key for concurrent credential checks depended on server state, causing non-existent usernames to collapse onto a shared key while configured usernames produced unique keys. This behavior allowed attackers to infer whether a username existed based on timing differences under concurrent requests. The fix modifies the singleflight key derivation to depend solely on submitted credentials, eliminating reliance on stored secrets and preventing the timing oracle.

Operators should verify whether their deployment is running a version from the v3.6 line or earlier, as these versions are affected and have reached end of life. Upgrading to v3.7.13 is essential to mitigate this vulnerability. Additionally, operators should assess whether their BasicAuth configuration might be exposed to attacker-controlled concurrency, as this specific scenario is required to exploit the issue. This vulnerability does not impact Traefik v2, nor does it affect Digest authentication, highlighting the importance of understanding middleware-specific behaviors across versions.