Advisoriesby IbisConsulGHSA-rqjq-mrgx-85hp
Allocation of Resources Without Limits or Throttling in Hashicorp Consul
Fix: upgrade to 1.6.6 or later (2 fixed versions below)
HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service.
Specific Go Packages Affected
github.com/hashicorp/consul/agent/config
Fix
The vulnerability is fixed in versions 1.6.6 and 1.7.4.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/consul Go | >= 1.2.0, < 1.6.6 | 1.6.6 |
| >= 1.7.0, < 1.7.4 | 1.7.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-770
- Also known as
- BIT-consul-2020-13250, CVE-2020-13250, GO-2022-0879
More Consul advisories
All Consul
Incorrect Authorization in HashiCorp ConsulCVE-2020-7955fixed in 1.6.3HashiCorp Consul L7 deny intention results in an allow actionCVE-2021-36213fixed in 1.10.1Hashicorp Consul Missing SSL Certificate ValidationCVE-2021-32574fixed in 1.10.1Incorrect Permission Assignment for Critical Resource in Hashicorp ConsulCVE-2020-12797fixed in 1.6.6 +1Improper Input Validation in HashiCorp ConsulCVE-2020-13170fixed in 1.6.6 +1Denial of Service (DoS) in HashiCorp ConsulCVE-2020-7219fixed in 1.6.3