medium6.5
CVE-2022-24687
HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers
Impact
HashiCorp Consul and Consul Enterprise 1.8.0 through 1.9.14, 1.10.7, and 1.11.2 has Uncontrolled Resource Consumption. Clusters with at least one ingress gateway configured may allow a user with `service:write` permission to register a specifically-defined service that can cause the Consul server to panic and shutdown. Versions 1.9.15, 1.10.8, and 1.11.3 contain patches for the problem.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/hashicorp/consul | >= 1.8.0, <= 1.9.14 | 1.9.15 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Consul | from 1.8.0 before 1.9.15 from 1.10.0 before 1.10.8 from 1.11.0 before 1.11.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://discuss.hashicorp.com
- https://discuss.hashicorp.com/t/hcsec-2022-05-consul-ingress-gateway-panic-can-shutdown-servers/
- https://security.gentoo.org/glsa/202208-09
- https://security.netapp.com/advisory/ntap-20220331-0006/
- https://github.com/advisories/GHSA-hj93-5fg3-3chr
- https://nvd.nist.gov/vuln/detail/CVE-2022-24687