PT-2020-13248 · Hashicorp · Hashicorp Consul Enterprise+1

Crhino · Published 2020-06-11 · Updated 2024-08-21 · CVE-2020-12758

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Consul and Consul Enterprise versions 1.6.0 through 1.6.5 HashiCorp Consul and Consul Enterprise versions 1.7.0 through 1.7.3

Description The issue is related to a denial of service (DoS) condition that can occur when HashiCorp Consul and Consul Enterprise are configured with an abnormally-formed service-router entry. This can cause the system to crash. The problem was introduced in version 1.6.0.

Recommendations For versions 1.6.0 through 1.6.5, update to version 1.6.6 to resolve the issue. For versions 1.7.0 through 1.7.3, update to version 1.7.4 to resolve the issue. As a temporary workaround, consider restricting the configuration of service-router entries to prevent abnormally-formed entries from causing a crash.

Fix

Improper Resource Release

Resource Exhaustion

Weakness Enumeration

CWE-404

CWE-400

Related Identifiers

BIT-CONSUL-2020-12758

CVE-2020-12758

GHSA-Q2QR-3C2P-9235

GO-2022-0861

Affected Products

Hashicorp Consul Enterprise

Hashicorp Consul

References · 13

• https://github.com/hashicorp/consul/pull/7783 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-12758 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-12758 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12758 · Security Note
• https://osv.dev/vulnerability/GHSA-q2qr-3c2p-9235 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12758 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0861 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-consul-2020-12758 · Vendor Advisory
• https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md · Note
• https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md · Note
• https://github.com/hashicorp/consul/commit/69b44fb9424cfdc05f1b7243876ab10d236ef1fc · Note
• https://github.com/advisories/GHSA-q2qr-3c2p-9235 · Note
• https://t.me/cvenotify/4322 · Telegram Post