CVE-2022-24687 — Uncontrolled Resource Consumption in Hashicorp Consul

CWE-400 — Uncontrolled Resource Consumption6 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.6%
top 29.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Hashicorp ConsulHashicorp ConsulDebian Consul
Timeline
PublishedFeb 24
Latest updateAug 21

Description

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDhashicorp/consul1.8.0 — 1.9.15+2
▶Gogithub.com/hashicorp_consul1.8.0 — 1.9.15+2
▶debiandebian/consul

🔴Vulnerability Details

4
OSV
HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers in github.com/hashicorp/consul↗2024-08-21
▶
GHSA
HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers↗2022-02-25
▶
OSV
HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers↗2022-02-25
▶
OSV
CVE-2022-24687: HashiCorp Consul and Consul Enterprise 1↗2022-02-24
▶

📋Vendor Advisories

1
Debian
CVE-2022-24687: consul - HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 ...↗2022
▶