PT-2020-19473 · Hashicorp+1 · Hashicorp Consul Enterprise+2

Published 2020-01-31 · Updated 2024-08-21 · CVE-2020-7219

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Consul and Consul Enterprise versions 1.6.2 and earlier

Description The issue allows unbounded resource usage and is susceptible to unauthenticated denial of service. This affects the HTTP/RPC services of HashiCorp Consul and Consul Enterprise.

Recommendations For versions 1.6.2 and earlier, update to version 1.6.3 to resolve the issue. As a temporary workaround, consider restricting access to the HTTP/RPC services to minimize the risk of exploitation.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

ALT-PU-2020-3391

ALT-PU-2020-3421

ALT-PU-2022-1256

BIT-CONSUL-2020-7219

CVE-2020-7219

GHSA-23JV-V6QJ-3FHH

GO-2022-0776

Affected Products

Alt Linux

Hashicorp Consul Enterprise

Hashicorp Consul

References · 14

• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7219 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-7219 · Vendor Advisory
• https://hashicorp.com/blog/category/consul · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7219 · Security Note
• https://osv.dev/vulnerability/GHSA-23jv-v6qj-3fhh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7219 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0776 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-7219 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-7219 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-7219 · Security Note
• https://osv.dev/vulnerability/BIT-consul-2020-7219 · Vendor Advisory
• https://github.com/hashicorp/consul/issues/7159 · Note
• https://t.me/cvenotify/697 · Telegram Post
• https://github.com/advisories/GHSA-23jv-v6qj-3fhh · Note