AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

ConsulGHSA-496g-fr33-whrf

Denial of service in HashiCorp Consul

Consul

CVE-2020-25201 · Published Jan 31, 2024 · updated Jun 28, 2024

High7.5
Fix: upgrade to 1.7.9 or later (2 fixed versions below)
GitHub advisory

HashiCorp Consul Enterprise versions 1.7.0 up to 1.7.8 and 1.8.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
>= 1.7.0, < 1.7.91.7.9
>= 1.8.0, < 1.8.51.8.5
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-400, CWE-834
Also known as
BIT-consul-2020-25201, CVE-2020-25201, GO-2024-2501

More Consul advisories

All Consul
High 8.1Oct 31, 2024Hashicorp Consul Path Traversal vulnerabilityCVE-2024-10005fixed in 1.20.1Medium 6.5Jan 31, 2024Privilege Escalation in HashiCorp ConsulCVE-2020-28053fixed in 1.6.10 +2High 7.4Aug 9, 2023Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT ProvidersCVE-2023-3518fixed in 1.16.1High 7.5Jun 9, 2023HashiCorp Consul Incorrect Access Control vulnerabilityCVE-2019-12291fixed in 1.5.1Medium 4.9Jun 3, 2023Hashicorp Consul vulnerable to denial of serviceCVE-2023-1297fixed in 1.14.5 +1High 8.7Jun 3, 2023Hashicorp Consul allows user with service:write permissions to patch remote proxy instancesCVE-2023-2816fixed in 1.15.3