CVE-2022-29153
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows red...
Résumé
Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector
Description d'origine
La description telle que publiée par la source (souvent en anglais).
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
consul
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.9.17"},{"introduced":"1.10.0"},{"fixed":"1.10.10"},{"introduced":"1.11.0"},{"fixed":"1.11.5"}]}]
Go
github.com/hashicorp/consul
[{"type":"SEMVER","events":[{"introduced":"1.11.0"},{"fixed":"1.11.5"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-29153 consul
Références
- advisory lists.fedoraproject.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.hashicorp.com
- web discuss.hashicorp.com
- web discuss.hashicorp.com
- web discuss.hashicorp.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web security.netapp.com