GitHub Advisoryadvisory · Go

GHSA-8449-7gc2-pwrp HashiCorp Consul Template could reveal Vault secret contents in error messages

HIGH Published 2022-08-18 Modified 2024-05-20 Official page ↗
Aliases
CVE-2022-38149
Ecosystem
Go
Packages
github.com/hashicorp/consul-template
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2022-08-30

Affected packages

• Go github.com/hashicorp/consul-template: < 0.27.3 → fixed in 0.27.3 • Go github.com/hashicorp/consul-template: >= 0.28.0, < 0.28.3 → fixed in 0.28.3 • Go github.com/hashicorp/consul-template: >= 0.29.0, < 0.29.2 → fixed in 0.29.2

Description

In HashiCorp Consul Template through version 0.29.1, invalid templates could inadvertently reveal the contents of Vault secret in errors returned by the `*template.Template.Execute 5` method, when given a template using Vault secret contents incorrectly. This method has been updated to redact Vault secrets when creating an error string, making it safe to log the error.. This issue was fixed in version 0.29.2.

Related

Alias · CVE (1)

  • CVE-2022-38149 HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References