Advisoriesby IbisConsulGHSA-c57c-7hrj-6q6v
Hashicorp Consul vulnerable to denial of service
Fix: upgrade to 1.14.5 or later (2 fixed versions below)
Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/consul Go | < 1.14.5 | 1.14.5 |
| >= 1.15.0, < 1.15.3 | 1.15.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-826
- Also known as
- BIT-consul-2023-1297, CVE-2023-1297, GO-2023-1827
More Consul advisories
All Consul
Denial of service in HashiCorp ConsulCVE-2020-25201fixed in 1.7.9 +1Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT ProvidersCVE-2023-3518fixed in 1.16.1HashiCorp Consul Incorrect Access Control vulnerabilityCVE-2019-12291fixed in 1.5.1Hashicorp Consul allows user with service:write permissions to patch remote proxy instancesCVE-2023-2816fixed in 1.15.3Consul Server Panic when Ingress and API Gateways Configured with Peering ConnectionsCVE-2023-0845fixed in 1.14.5Missing Authorization in HashiCorp ConsulCVE-2022-3920fixed in 1.14.0