CVE-2022-29153
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows red...
Summary
Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector
Original description
The description as published by the source.
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
consul
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.17"},{"introduced":"1.10.0"},{"fixed":"1.10.10"},{"introduced":"1.11.0"},{"fixed":"1.11.5"}]}]
Go
github.com/hashicorp/consul
[{"type":"SEMVER","events":[{"introduced":"1.11.0"},{"fixed":"1.11.5"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-29153 consul
References
- advisory lists.fedoraproject.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.hashicorp.com
- web discuss.hashicorp.com
- web discuss.hashicorp.com
- web discuss.hashicorp.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web security.netapp.com