What is GHSA-q2qr-3c2p-9235?

GHSA-q2qr-3c2p-9235 is a security advisory published by GitHub Security Advisories with Medium severity. Denial of Service (DoS) in HashiCorp Consul

Which CVE IDs does GHSA-q2qr-3c2p-9235 cover?

GHSA-q2qr-3c2p-9235 covers the following CVE IDs: CVE-2020-12758. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q2qr-3c2p-9235?

GHSA-q2qr-3c2p-9235 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-q2qr-3c2p-9235?

GHSA-q2qr-3c2p-9235 affects 2 products, including: go/github.com/hashicorp/consul:\u003e= 1.6.0-beta1, \u003c 1.6.6; go/github.com/hashicorp/consul:\u003e= 1.7.0, \u003c 1.7.4.

GHSA-q2qr-3c2p-9235MediumCVSS 5.3

Denial of Service (DoS) in HashiCorp Consul

Vendor

GitHub Security Advisories

Published

February 15, 2022

Last Modified

October 2, 2023

🔗 CVE IDs covered (1)

CVE-2020-12758 →

📋 Description

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4.

Specific Go Packages Affected

github.com/hashicorp/consul/agent/consul/discoverychain

🎯 Affected products2

go/github.com/hashicorp/consul:>= 1.6.0-beta1, < 1.6.6
go/github.com/hashicorp/consul:>= 1.7.0, < 1.7.4

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2020-12758
https://github.com/hashicorp/consul/pull/7783
https://github.com/hashicorp/consul/commit/69b44fb9424cfdc05f1b7243876ab10d236ef1fc
https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md
https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md
https://github.com/advisories/GHSA-q2qr-3c2p-9235