CVE-2022-24687

CVE-2022-24687 affects HashiCorp Consul and Consul Enterprise clusters: versions 1.9.0–1.9.14, 1.10.7, and 1.11.2 are vulnerable. A user with the service:write permission on an Ingress Gateway can register a specially-crafted service that may cause Consul servers to panic, impacting availability....

CVE-2022-24687

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3...

CVE-2022-24687

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3...

CVE-2022-24687

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3...

CVE-2022-24687

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3...

CVE-2022-24687: Undefined Security Weakness

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3...

HashiCorp Consul 资源管理错误漏洞

HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp USA. The product is used to connect and provision applications across a dynamically distributed infrastructure. A resource management error vulnerability exists in HashiCorp Consul and Consul...

Consul Ingress Gateway Panic Can Shutdown Servers

Summary Consul and Consul Enterprise “Consul” clusters with at least one Ingress Gateway allow a user with service:write permissions to register a specifically-defined service that will cause the Consul server to panic. This vulnerability, CVE-2022-24687, was fixed in Consul 1.9.15, 1.10.8, and...

Denial of Service (DoS) in HashiCorp Consul

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4. Specific Go Packages Affected github.com/hashicorp/consul/agent/consul/discoverychain...

GHSA-Q2QR-3C2P-9235 Denial of Service (DoS) in HashiCorp Consul

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4. Specific Go Packages Affected github.com/hashicorp/consul/agent/consul/discoverychain...

Important Photon OS Security Update - PHSA-2022-0143

Updates of 'consul', 'openssl' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2022-4.0-0143

Updates of 'consul', 'openssl' packages of Photon OS have been released...

Photon OS 3.0: Consul PHSA-2021-3.0-0346

An update of the consul package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0346. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Critical Photon OS Security Update - PHSA-2021-0346

Updates of 'bluez', 'consul', 'pkg-config', 'vim', 'httpd' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2021-3.0-0346

Updates of 'bluez', 'vim', 'consul', 'httpd', 'pkg-config' packages of Photon OS have been released...

Vault, Consul, Boundary, and Waypoint Affected By Denial of Service in Golang’s net/http (CVE-2021-44716)

Summary A denial of service vulnerability was reported in Golang’s net/http package. This vulnerability, CVE-2021-44716, was fixed in conjunction with another security issue in Go releases 1.16.12 and 1.17.5, and subsequently addressed with new releases of the affected HashiCorp products listed...

Privilege Escalation

github.com/hashicorp/consul is vulnerable to privilege escalation. The vulnerability exists because ACL tokens in one namespace can be used to bypass security restrictions in a different namespace when they contain default operator:write permissions...

CVE-2021-41805

HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token with the default operator:write permissions in one namespace can be used for unintended privilege escalation in a different namespace...

CVE-2021-41805

HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token with the default operator:write permissions in one namespace can be used for unintended privilege escalation in a different namespace...

CVE-2021-41805

HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token with the default operator:write permissions in one namespace can be used for unintended privilege escalation in a different namespace...