GitHub Advisoryadvisory · Go

GHSA-rqjq-mrgx-85hp Allocation of Resources Without Limits or Throttling in Hashicorp Consul

HIGH Published 2021-05-18 Modified 2023-10-02 Official page ↗
Aliases
CVE-2020-13250
Ecosystem
Go
Packages
github.com/hashicorp/consul
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-770
Reviewed
2021-05-12

Affected packages

• Go github.com/hashicorp/consul: >= 1.2.0, < 1.6.6 → fixed in 1.6.6 • Go github.com/hashicorp/consul: >= 1.7.0, < 1.7.4 → fixed in 1.7.4

Description

HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Specific Go Packages Affected github.com/hashicorp/consul/agent/config Fix The vulnerability is fixed in versions 1.6.6 and 1.7.4.

Related

Alias · CVE (1)

  • CVE-2020-13250 HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was… vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References