GitHub Advisoryadvisory · Go

GHSA-c57c-7hrj-6q6v Hashicorp Consul vulnerable to denial of service

MEDIUM Published 2023-06-03 Modified 2023-06-06 Official page ↗
Aliases
CVE-2023-1297
Ecosystem
Go
Packages
github.com/hashicorp/consul
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-826
Reviewed
2023-06-06

Affected packages

• Go github.com/hashicorp/consul: < 1.14.5 → fixed in 1.14.5 • Go github.com/hashicorp/consul: >= 1.15.0, < 1.15.3 → fixed in 1.15.3

Description

Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3

Related

Alias · CVE (1)

  • CVE-2023-1297 Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a… vulnerability

Weakness · CWE (1)

  • CWE-826 Premature Release of Resource During Expected Lifetime weakness

References