GHSA-wj6x-hcc2-f32j

Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-wj6x-hcc2-f32j/GHSA-wj6x-hcc2-f32j.json
Aliases
  • CVE-2023-0845
Published
2023-03-09T18:30:30Z
Modified
2023-03-16T16:04:18Z
Details

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) an authenticated user with service:write permissions could trigger a workflow that causes Consul server and client agents to crash under certain circumstances. To exploit this vulnerability, an attacker requires access to an ACL token with service:write permissions, and there needs to be at least one running ingress or API gateway that is configured to route traffic to an upstream service.

References

Affected packages

Go / github.com/hashicorp/consul

github.com/hashicorp/consul

Affected ranges

Type
SEMVER
Events
Introduced
1.14.0
Fixed
1.14.5

Affected versions