PT-2020-16014 · Hashicorp · Hashicorp Consul Enterprise

Published 2020-11-04 · Updated 2024-06-28 · CVE-2020-25201

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Consul Enterprise versions 1.7.0 through 1.8.4

Description The issue is related to a namespace replication bug in HashiCorp Consul Enterprise, which can be triggered to cause denial of service via infinite Raft writes.

Recommendations For versions 1.7.0 through 1.7.8, update to version 1.7.9 to resolve the issue. For versions 1.8.0 through 1.8.4, update to version 1.8.5 to resolve the issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-834

CWE-400

Related Identifiers

BIT-CONSUL-2020-25201

CVE-2020-25201

GHSA-496G-FR33-WHRF

GO-2024-2501

Affected Products

Hashicorp Consul Enterprise

References · 19

• https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#185-october-23-2020 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-496g-fr33-whrf · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25201 · Vendor Advisory
• https://hashicorp.com/blog/category/consul · Vendor Advisory
• https://security.gentoo.org/glsa/202208-09 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25201 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-25201 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2501 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-consul-2020-25201 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25201 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-25201 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25201 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25201 · Security Note
• https://github.com/hashicorp/consul/releases/tag/v1.8.5 · Note
• https://github.com/hashicorp/consul/pull/9024 · Note