~ / search / GHSA-wj6x-hcc2-f32j

GHSA-wj6x-hcc2-f32j

Consul Server Panic when Ingress and API Gateways Configured with Peering Connections

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-0845

Packages

EcosystemPackageAffectedFixed in
Go github.com/hashicorp/consul >= 1.14.0, < 1.14.5 1.14.5

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) an authenticated user with service:write permissions could trigger a workflow that causes Consul server and client agents to crash under certain circumstances. To exploit this vulnerability, an attacker requires access to an ACL token with service:write permissions, and there needs to be at least one running ingress or API gateway that is configured to route traffic to an upstream service.

References

External links from the advisory. They lead to third-party sites.