Skip to content
OpenAdvisories

Package · Alpine

consul

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 5.3
    CVE-2022-3920

    Consul Peering Imported Nodes/Services Leak

    HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.

    HashiCorp Consul Enterprise Consul consul Ubuntu Alpine Go
  • Medium 6.5
    CVE-2022-40716

    HashiCorp Consul vulnerable to authorization bypass

    HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13…

    consul consul github.com/hashicorp/consul consul Debian Ubuntu Alpine Go
  • High 7.1
    CVE-2021-41803

    HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions

    HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."

    consul consul github.com/hashicorp/consul consul Debian Ubuntu Alpine Go
  • Medium 6.5
    CVE-2022-24687

    HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers

    HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10…

    consul consul github.com/hashicorp/consul consul Debian Ubuntu Alpine Go
  • Unscored —
    CVE-2021-28156

    HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fi…

    consul consul Ubuntu Alpine
  • Medium 6.1
    CVE-2020-25864

    HashiCorp Consul Cross-site Scripting vulnerability

    HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.

    consul consul github.com/hashicorp/consul consul Debian Ubuntu Alpine Go