Vulnerability · Published Jun 2, 2023 · Assigned by HashiCorp
CVE-2023-1297 Consul Cluster Peering can Result in Denial of Service
Medium 4.9
In plain English
A medium-severity security flaw in Consul from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.8%top 44.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hashicorp/consul | 1.14.5 | GHSA-c57c-7hrj-6q6v |
| Go | github.com/hashicorp/consul | 1.15.3 | GHSA-c57c-7hrj-6q6v |
| Go | github.com/hashicorp/consul | 1.14.5, 1.15.3 | GO-2023-1827 |
| Ubuntu:22.04:LTS | consul | no fix listed | UBUNTU-CVE-2023-1297 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Consul | 1.14.0 – through 1.14.51.15.0 – through 1.15.3 |
| HashiCorp | Consul Enterprise | 1.14.0 – through 1.14.51.15.0 – through 1.15.3 |
Weakness: CWE-826 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H