Description
HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | consul-template | 0.29.2-r0 | — |
| Alpine v3.23 | consul-template | 0.29.2-r0 | — |
| Alpine v3.22 | consul-template | 0.29.2-r0 | — |
| Alpine v3.21 | consul-template | 0.29.2-r0 | — |
| Alpine v3.20 | consul-template | 0.29.2-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | consul-template | 0.29.2-r0 | — |
| Alpine v3.18 | consul-template | 0.29.2-r0 | — |
| Alpine v3.17 | consul-template | 0.29.2-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/hashicorp/consul-template | < 0.27.3 | 0.27.3 | GHSA-8449-7gc2-pwrp |
| Go | github.com/hashicorp/consul-template | >= 0.28.0, < 0.28.3 | 0.28.3 | GHSA-8449-7gc2-pwrp |
| Go | github.com/hashicorp/consul-template | >= 0.29.0, < 0.29.2 | 0.29.2 | GHSA-8449-7gc2-pwrp |
| Go | github.com/hashicorp/consul-template | < 0.27.3 · >= 0.28.0, < 0.28.3 · >= 0.29.0, < 0.29.2 | 0.27.3, 0.28.3, 0.29.2 | GO-2022-0980 |
Advisories 1
- WID-SEC-2023-1542 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025