CVE-2023-0845 Consul Server Panic when Ingress and API Gateways Configured with Peering

2023-03-0915:14:26

CWE-476

HashiCorp

www.cve.org

cve-2023-0845

consul

enterprise

authenticated user

service write

workflow

crash

fixed

1.14.5

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.9%

JSON

Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain circumstances. This vulnerability was fixed in Consul 1.14.5.

CNA Affected

[
  {
    "vendor": "HashiCorp",
    "product": "Consul",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "repo": "https://github.com/hashicorp/consul",
    "versions": [
      {
        "status": "affected",
        "version": "1.14.0"
      },
      {
        "status": "affected",
        "version": "1.14.1"
      },
      {
        "status": "affected",
        "version": "1.14.2"
      },
      {
        "status": "affected",
        "version": "1.14.3"
      },
      {
        "status": "affected",
        "version": "1.14.4"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "HashiCorp",
    "product": "Consul Enterprise",
    "platforms": [
      "64 bit",
      "32 bit",
      "x86",
      "ARM",
      "MacOS",
      "Windows",
      "Linux"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "1.14.0"
      },
      {
        "status": "affected",
        "version": "1.14.1"
      },
      {
        "status": "affected",
        "version": "1.14.2"
      },
      {
        "status": "affected",
        "version": "1.14.3"
      },
      {
        "status": "affected",
        "version": "1.14.4"
      }
    ],
    "defaultStatus": "unaffected"
  }
]