ConsulGHSA-rqjq-mrgx-85hp
Allocation of Resources Without Limits or Throttling in Hashicorp Consul
High7.5CVE-2020-13250 · Published May 18, 2021 · updated Aug 21, 2024
HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. ### Specific Go Packages Affected github.com/hashicorp/consul/agent/config ### Fix The vulnerability is fixed in versions 1.6.6 and 1.7.4.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/consul Go | >= 1.2.0, < 1.6.6 | 1.6.6 |
| >= 1.7.0, < 1.7.4 | 1.7.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-770
- Also known as
- BIT-consul-2020-13250, CVE-2020-13250, GO-2022-0879
More Consul advisories
All Consul| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 282021 | Incorrect Authorization in HashiCorp Consul Medium5.3Jul 28, 2021 | Medium5.3 | 1.6.3 |
| Jul 192021 | HashiCorp Consul L7 deny intention results in an allow actionHigh7.5Jul 19, 2021 | High7.5 | 1.10.1 |
| Jul 192021 | Hashicorp Consul Missing SSL Certificate ValidationHigh7.5Jul 19, 2021 | High7.5 | 1.10.1 |
| Jun 232021 | Incorrect Permission Assignment for Critical Resource in Hashicorp ConsulMedium5.3Jun 23, 2021 | Medium5.3 | 1.6.6+1 more |
| May 182021 | Improper Input Validation in HashiCorp ConsulMedium5.3May 18, 2021 | Medium5.3 | 1.6.6+1 more |
| May 182021 | Denial of Service (DoS) in HashiCorp ConsulHigh7.5May 18, 2021 | High7.5 | 1.6.3 |