GHSA-wj6x-hcc2-f32j

Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-wj6x-hcc2-f32j/GHSA-wj6x-hcc2-f32j.json

Aliases

• CVE-2023-0845

Published

2023-03-09T18:30:30Z

Modified

2023-03-16T16:04:18Z

Details

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) an authenticated user with service:write permissions could trigger a workflow that causes Consul server and client agents to crash under certain circumstances. To exploit this vulnerability, an attacker requires access to an ACL token with service:write permissions, and there needs to be at least one running ingress or API gateway that is configured to route traffic to an upstream service.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-0845
• https://discuss.hashicorp.com/t/hcsec-2023-06-consul-server-panic-when-ingress-and-api-gateways-configured-with-peering-connections/51197
• https://github.com/hashicorp/consul