~ / search / GHSA-q6h7-4qgw-2j9p

GHSA-q6h7-4qgw-2j9p

Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector

Source: GitHub Advisory Database (reviewed) High CVE-2022-29153

Packages

EcosystemPackageAffectedFixed in
Go github.com/hashicorp/consul < 1.9.17 1.9.17
Go github.com/hashicorp/consul >= 1.10.0, < 1.10.10 1.10.10
Go github.com/hashicorp/consul >= 1.11.0, < 1.11.5 1.11.5

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that HTTP health check endpoints returning an HTTP redirect may be abused as a vector for server-side request forgery (SSRF). This vulnerability, CVE-2022-29153, was fixed in Consul 1.9.17, 1.10.10, and 1.11.5.

References

External links from the advisory. They lead to third-party sites.