All errata/sisyphus/ALT-PU-2023-1696-2
ALT-PU-2023-1696-2

Package update consul in branch sisyphus

Version1.15.2-alt1
Task#319710
Published2026-02-04
Max severityHIGH
Severity:

Closed issues (12)

BDU:2023-01973
MEDIUM6.5

Уязвимость инструмента настройки сервисов Consul и Consul Enterprise, связанная с ошибками разыменования указателей, позволяющая нарушителю вызвать аварийное завершение работы приложения

Published: 2023-04-11Modified: 2023-04-19
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0MEDIUM 6.1
CVSS:2.0/AV:N/AC:L/Au:M/C:N/I:N/A:C
References
BDU:2025-04574
HIGH7.1

Уязвимость компонента Name Handler инструмента настройки сервисов Consul и Consul Enterprise, позволяющая нарушителю получить доступ к потенциально конфиденциальной информации

Published: 2025-04-15
CVSS 3.xHIGH 7.1
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:C
References
BDU:2025-04575
HIGH7.5

Уязвимость инструмента настройки сервисов Consul и Consul Enterprise, связанная с недостаточной проверкой запросов на стороне сервера, позволяющая нарушителю осуществить атаку SSRF

Published: 2025-04-15
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:C/A:N
References
BDU:2025-08591
MEDIUM6.5

Уязвимость инструмента настройки сервисов Consul и Consul Enterprise, связанная с непроверенным возвращенным значением, позволяющая нарушителю обойти внедренные ограничения безопасности

Published: 2025-07-17
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:C/A:N
References
CVE-2021-41803
HIGH7.1

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."

Published: 2022-09-23Modified: 2025-05-27
CVSS 3.xHIGH 7.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
References
CVE-2022-29153
HIGH7.5

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.

Published: 2022-04-19Modified: 2024-11-21
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
CVE-2022-40716
MEDIUM6.5

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."

Published: 2022-09-23Modified: 2025-05-27
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
CVE-2023-0845
MEDIUM6.5

Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain circumstances. This vulnerability was fixed in Consul 1.14.5.

Published: 2023-03-09Modified: 2024-11-21
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
GHSA-hr3v-8cp3-68rf
HIGH7.1

HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions

Published: 2022-09-25Modified: 2024-04-22
CVSS 3.xHIGH 7.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
References
GHSA-m69r-9g56-7mv8
MEDIUM6.5

HashiCorp Consul vulnerable to authorization bypass

Published: 2022-09-25Modified: 2023-09-06
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
GHSA-q6h7-4qgw-2j9p
HIGH7.5

Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector

Published: 2022-04-20Modified: 2022-12-27
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
GHSA-wj6x-hcc2-f32j
MEDIUM6.5

Consul Server Panic when Ingress and API Gateways Configured with Peering Connections

Published: 2023-03-09Modified: 2023-09-20
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References