GHSA-wj6x-hcc2-f32j

Source
https://github.com/advisories/GHSA-wj6x-hcc2-f32j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-wj6x-hcc2-f32j/GHSA-wj6x-hcc2-f32j.json
Aliases
Published
2023-03-09T18:30:30Z
Modified
2023-12-06T01:02:46.115753Z
Details

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) an authenticated user with service:write permissions could trigger a workflow that causes Consul server and client agents to crash under certain circumstances. To exploit this vulnerability, an attacker requires access to an ACL token with service:write permissions, and there needs to be at least one running ingress or API gateway that is configured to route traffic to an upstream service.

References

Affected packages

Go / github.com/hashicorp/consul

Affected ranges

Type
SEMVER
Events
Introduced
1.14.0
Fixed
1.14.5