What is GHSA-rqjq-mrgx-85hp?

GHSA-rqjq-mrgx-85hp is a security advisory published by GitHub Security Advisories with High severity. Allocation of Resources Without Limits or Throttling in Hashicorp Consul

Which CVE IDs does GHSA-rqjq-mrgx-85hp cover?

GHSA-rqjq-mrgx-85hp covers the following CVE IDs: CVE-2020-13250. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rqjq-mrgx-85hp?

GHSA-rqjq-mrgx-85hp has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-rqjq-mrgx-85hp?

GHSA-rqjq-mrgx-85hp affects 2 products, including: go/github.com/hashicorp/consul:\u003e= 1.2.0, \u003c 1.6.6; go/github.com/hashicorp/consul:\u003e= 1.7.0, \u003c 1.7.4.

GHSA-rqjq-mrgx-85hpHighCVSS 7.5

Allocation of Resources Without Limits or Throttling in Hashicorp Consul

Vendor

GitHub Security Advisories

Published

May 18, 2021

Last Modified

October 2, 2023

🔗 CVE IDs covered (1)

CVE-2020-13250 →

📋 Description

HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service.

Specific Go Packages Affected

github.com/hashicorp/consul/agent/config

Fix

The vulnerability is fixed in versions 1.6.6 and 1.7.4.

🎯 Affected products2

go/github.com/hashicorp/consul:>= 1.2.0, < 1.6.6
go/github.com/hashicorp/consul:>= 1.7.0, < 1.7.4

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2020-13250
https://github.com/hashicorp/consul/pull/8023
https://github.com/hashicorp/consul/commit/72f92ae7ca4cabc1dc3069362a9b64ef46941432
https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md
https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md
https://github.com/advisories/GHSA-rqjq-mrgx-85hp