PT-2022-19418 · Hashicorp+3 · Hashicorp Consul+4

Published 2022-04-19 · Updated 2025-04-02 · CVE-2022-29153

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Consul and Consul Enterprise versions 1.9.16 and earlier, 1.10.9 and earlier, 1.11.4 and earlier

Description A server-side request forgery issue may occur when the Consul client agent follows redirects returned by HTTP health check endpoints. This can be abused as a vector for server-side request forgery (SSRF).

Recommendations For versions 1.9.16 and earlier, update to version 1.9.17 or later. For versions 1.10.9 and earlier, update to version 1.10.10 or later. For versions 1.11.4 and earlier, update to version 1.11.5 or later. As a temporary workaround, consider restricting access to the HTTP health check endpoints to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

ALT-PU-2023-1696

ALT-PU-2023-7106

ALT-PU-2024-8028

BDU:2025-04575

BIT-CONSUL-2022-29153

CVE-2022-29153

GHSA-Q6H7-4QGW-2J9P

GO-2022-0615

MGASA-2023-0009

Affected Products

Alt Linux

Hashicorp Consul Enterprise

Debian

Hashicorp Consul

Red Os

References · 35

• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/RQQ4E3JBXVR3VK5FIZVJ3QS2TAOOXXTQ · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-29153 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04575 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-29153 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBODKZL7HQE5XXS3SA2VIDVL4LAA5RWH · Vendor Advisory
• https://security.gentoo.org/glsa/202208-09 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q6h7-4qgw-2j9p · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-29153 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29153 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29153 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-29153 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0009 · Vendor Advisory
• https://discuss.hashicorp.com · Vendor Advisory