Description
HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | consul | 1.8.7+dfsg1-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | consul | No fix yet | — |
| Ubuntu 20.04 LTS | consul | No fix yet | — |
| Ubuntu 18.04 LTS | consul | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.18 | consul | 1.9.5-r0 | — |
| Alpine v3.17 | consul | 1.9.5-r0 | — |
| Alpine v3.16 | consul | 1.9.5-r0 | — |
| Alpine v3.15 | consul | 1.9.5-r0 | — |
| Alpine v3.14 | consul | 1.9.5-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.13 | consul | 1.9.5-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | k3d +2 | 5.6.0-r11 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- HashiCorp Consul/Consul Enterprise <=1.9.4 - Cross-Site Scripting http/cves/2020/CVE-2020-25864.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/hashicorp/consul | >= 1.9.0, < 1.9.5 | 1.9.5 | GHSA-8xmx-h8rq-h94j |
| Go | github.com/hashicorp/consul | >= 1.8.0, < 1.8.10 | 1.8.10 | GHSA-8xmx-h8rq-h94j |
| Go | github.com/hashicorp/consul | < 1.7.14 | 1.7.14 | GHSA-8xmx-h8rq-h94j |
| Go | github.com/hashicorp/consul | < 1.7.14 · >= 1.8.0, < 1.8.10 · >= 1.9.0, < 1.9.5 | 1.7.14, 1.8.10, 1.9.5 | GO-2023-1851 |