CVE-2022-29153
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows red...
概要
Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
consul
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.17"},{"introduced":"1.10.0"},{"fixed":"1.10.10"},{"introduced":"1.11.0"},{"fixed":"1.11.5"}]}]
Go
github.com/hashicorp/consul
[{"type":"SEMVER","events":[{"introduced":"1.11.0"},{"fixed":"1.11.5"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-29153 consul
参照URL
- advisory lists.fedoraproject.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.hashicorp.com
- web discuss.hashicorp.com
- web discuss.hashicorp.com
- web discuss.hashicorp.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web security.netapp.com