AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

ConsulGHSA-q2qr-3c2p-9235

Denial of Service (DoS) in HashiCorp Consul

Consul

CVE-2020-12758 · Published Feb 15, 2022 · updated Aug 21, 2024

Medium5.3
Fix: upgrade to 1.6.6 or later (2 fixed versions below)
GitHub advisory

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4.

Specific Go Packages Affected

github.com/hashicorp/consul/agent/consul/discoverychain

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
>= 1.6.0-beta1, < 1.6.61.6.6
>= 1.7.0, < 1.7.41.7.4
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Severity from
GitHub (reviewed advisory)
Weakness
CWE-400
Also known as
BIT-consul-2020-12758, CVE-2020-12758, GO-2022-0861

More Consul advisories

All Consul
Medium 6.1May 24, 2022HashiCorp Consul Cross-site Scripting vulnerabilityCVE-2020-25864fixed in 1.7.14 +2Medium 5.9May 14, 2022HashiCorp Consul can use cleartext agent-to-agent RPC communicationCVE-2018-19653fixed in 1.4.1High 7.4May 13, 2022HashiCorp Consul vulnerable to Origin Validation ErrorCVE-2019-9764fixed in 1.4.4High 8.1May 13, 2022HashiCorp Consul Access Restriction BypassCVE-2019-8336fixed in 1.4.3High 7.5Apr 20, 2022Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vectorCVE-2022-29153fixed in 1.9.17 +2Medium 6.5Feb 25, 2022HashiCorp Consul Ingress Gateway Panic Can Shutdown ServersCVE-2022-24687fixed in 1.9.15 +2