What is GHSA-hj93-5fg3-3chr?

GHSA-hj93-5fg3-3chr is a security advisory published by GitHub Security Advisories with Medium severity. HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers

Which CVE IDs does GHSA-hj93-5fg3-3chr cover?

GHSA-hj93-5fg3-3chr covers the following CVE IDs: CVE-2022-24687. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hj93-5fg3-3chr?

GHSA-hj93-5fg3-3chr has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-hj93-5fg3-3chr?

GHSA-hj93-5fg3-3chr affects 3 products, including: go/github.com/hashicorp/consul:\u003e= 1.8.0, \u003c= 1.9.14; go/github.com/hashicorp/consul:\u003e= 1.10.0, \u003c= 1.10.7; go/github.com/hashicorp/consul:\u003e= 1.11.0, \u003c= 1.11.2.

GHSA-hj93-5fg3-3chrMediumCVSS 6.5

HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers

Vendor

GitHub Security Advisories

Published

February 25, 2022

Last Modified

January 30, 2023

🔗 CVE IDs covered (1)

CVE-2022-24687 →

📋 Description

HashiCorp Consul and Consul Enterprise 1.8.0 through 1.9.14, 1.10.7, and 1.11.2 has Uncontrolled Resource Consumption. Clusters with at least one ingress gateway configured may allow a user with service:write permission to register a specifically-defined service that can cause the Consul server to panic and shutdown. Versions 1.9.15, 1.10.8, and 1.11.3 contain patches for the problem.

🎯 Affected products3

go/github.com/hashicorp/consul:>= 1.8.0, <= 1.9.14
go/github.com/hashicorp/consul:>= 1.10.0, <= 1.10.7
go/github.com/hashicorp/consul:>= 1.11.0, <= 1.11.2

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2022-24687
https://discuss.hashicorp.com
https://discuss.hashicorp.com/t/hcsec-2022-05-consul-ingress-gateway-panic-can-shutdown-servers/
https://security.netapp.com/advisory/ntap-20220331-0006/
https://security.gentoo.org/glsa/202208-09
https://github.com/advisories/GHSA-hj93-5fg3-3chr