PT-2020-13397 · Hashicorp+1 · Hashicorp Consul Enterprise+2

Published 2020-06-11 · Updated 2024-08-21 · CVE-2020-13250

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Consul versions 1.2.0 through 1.6.5 HashiCorp Consul versions 1.4.3 through 1.7.3

Description The issue is related to a denial of service vulnerability in the HTTP API and DNS caching feature of HashiCorp Consul and Consul Enterprise. The HTTP API was introduced in version 1.2.0, and the DNS caching feature was introduced in version 1.4.3.

Recommendations For HashiCorp Consul versions 1.2.0 through 1.6.5, update to version 1.6.6 or later. For HashiCorp Consul versions 1.4.3 through 1.7.3, update to version 1.7.4 or later.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2020-3391

ALT-PU-2020-3421

ALT-PU-2022-1256

BIT-CONSUL-2020-13250

CVE-2020-13250

GHSA-RQJQ-MRGX-85HP

GO-2022-0879

Affected Products

Alt Linux

Hashicorp Consul Enterprise

Hashicorp Consul

References · 16

• https://github.com/hashicorp/consul/pull/8023 · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-13250 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13250 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13250 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-13250 · Security Note
• https://osv.dev/vulnerability/BIT-consul-2020-13250 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13250 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rqjq-mrgx-85hp · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-13250 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0879 · Vendor Advisory
• https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md · Note
• https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md · Note
• https://github.com/hashicorp/consul/commit/72f92ae7ca4cabc1dc3069362a9b64ef46941432 · Note
• https://t.me/cvenotify/4325 · Telegram Post