PT-2022-24241 · Hashicorp · Hashicorp Consul Template

Fulton Byrne · Published 2022-08-17 · Updated 2022-09-21 · CVE-2022-38149

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Consul Template versions 0.27.2 and earlier, 0.28.2 and earlier, 0.29.1 and earlier

Description The issue concerns the potential exposure of Vault secrets in error messages returned by the *template.Template.Execute method when a template using Vault secret contents is used incorrectly. This could lead to the revelation of sensitive information in logs or error reports. The problem arises when invalid templates are used, causing the method to inadvertently include Vault secrets in the error string.

Recommendations For HashiCorp Consul Template versions 0.27.2 and earlier, update to version 0.27.3 or later. For HashiCorp Consul Template versions 0.28.2 and earlier, update to version 0.28.3 or later. For HashiCorp Consul Template versions 0.29.1 and earlier, update to version 0.29.2 or later.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2022-38149

GHSA-8449-7GC2-PWRP

GO-2022-0980

Affected Products

Hashicorp Consul Template

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2022-38149 · Security Note
• https://discuss.hashicorp.com/t/hsec-2022-16-consul-template-may-expose-vault-secrets-when-processing-invalid-input/43215 · Vendor Advisory
• https://discuss.hashicorp.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38149 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8449-7gc2-pwrp · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0980 · Vendor Advisory
• https://github.com/hashicorp/consul · Note
• https://github.com/hashicorp/consul-template/commit/d6a6f4af219c28e67d847ba0e0b2bea8f5bb9076 · Note
• https://pkg.go.dev/vuln/GO-2022-0980 · Note
• https://t.me/cvenotify/34801 · Telegram Post
• https://t.me/cibsecurity/48281 · Telegram Post