Advisoriesby IbisConsulGHSA-hj93-5fg3-3chr
HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers
Fix: upgrade to 1.9.15 or later (3 fixed versions below)
HashiCorp Consul and Consul Enterprise 1.8.0 through 1.9.14, 1.10.7, and 1.11.2 has Uncontrolled Resource Consumption. Clusters with at least one ingress gateway configured may allow a user with service:write permission to register a specifically-defined service that can cause the Consul server to panic and shutdown. Versions 1.9.15, 1.10.8, and 1.11.3 contain patches for the problem.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/consul Go | >= 1.8.0, < 1.9.15 | 1.9.15 |
| >= 1.10.0, < 1.10.8 | 1.10.8 | |
| >= 1.11.0, < 1.11.3 | 1.11.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-400
- Also known as
- BIT-consul-2022-24687, CVE-2022-24687, GO-2022-0953
More Consul advisories
All Consul
HashiCorp Consul Cross-site Scripting vulnerabilityCVE-2020-25864fixed in 1.7.14 +2HashiCorp Consul can use cleartext agent-to-agent RPC communicationCVE-2018-19653fixed in 1.4.1HashiCorp Consul vulnerable to Origin Validation ErrorCVE-2019-9764fixed in 1.4.4HashiCorp Consul Access Restriction BypassCVE-2019-8336fixed in 1.4.3Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vectorCVE-2022-29153fixed in 1.9.17 +2Denial of Service (DoS) in HashiCorp ConsulCVE-2020-12758fixed in 1.6.6 +1