PT-2022-16801 · Hashicorp+2 · Hashicorp Consul+4

Published 2022-02-16 · Updated 2024-08-21 · CVE-2022-24687

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Consul and Consul Enterprise versions 1.8.0 through 1.9.14 HashiCorp Consul and Consul Enterprise version 1.10.7 HashiCorp Consul and Consul Enterprise version 1.11.2

Description The issue allows a user with service:write permission to register a specifically-defined service that can cause Consul servers to panic and shutdown. This is due to uncontrolled resource consumption in clusters with at least one Ingress Gateway configured.

Recommendations For versions 1.8.0 through 1.9.14, update to version 1.9.15 or later. For version 1.10.7, update to version 1.10.8 or later. For version 1.11.2, update to version 1.11.3 or later. As a temporary workaround, consider restricting the service:write permission to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2022-1315

ALT-PU-2023-7106

ALT-PU-2024-8028

BIT-CONSUL-2022-24687

CVE-2022-24687

GHSA-HJ93-5FG3-3CHR

GO-2022-0953

Affected Products

Alt Linux

Hashicorp Consul Enterprise

Debian

Hashicorp Consul

Ingress Gateway

References · 18

• https://security-tracker.debian.org/tracker/CVE-2022-24687 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0953 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2022-05-consul-ingress-gateway-panic-can-shutdown-servers · Vendor Advisory
• https://discuss.hashicorp.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24687 · Security Note
• https://osv.dev/vulnerability/GHSA-hj93-5fg3-3chr · Vendor Advisory
• https://osv.dev/vulnerability/BIT-consul-2022-24687 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24687 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24687 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-09 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24687 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-24687 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24687 · Vendor Advisory
• https://github.com/hashicorp/consul · Note
• https://github.com/advisories/GHSA-hj93-5fg3-3chr · Note