CVEvulnerability
CVE-2022-29153
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-04-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-918
Description
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.
Affected configurations
• hashicorp consul (< 1.9.17)
• hashicorp consul (>= 1.10.0 < 1.10.10)
• hashicorp consul (>= 1.11.0 < 1.11.5)
• fedoraproject fedora 37
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://discuss.hashicorp.com Vendor Advisory
- https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/ Vendor Advisory
- https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393 Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBODKZL7HQE5XXS3SA2VIDVL4LAA5RWH/ Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202208-09 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220602-0005/ Third Party Advisory
- https://discuss.hashicorp.com Vendor Advisory
- https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/ Vendor Advisory
- https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393 Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBODKZL7HQE5XXS3SA2VIDVL4LAA5RWH/ Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202208-09 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220602-0005/ Third Party Advisory