Allocation of Resources Without Limits or Throttling in Hashicorp Consul
HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. ### Specific Go Packages Affected github.com/hashicorp/consul/agent/config ### Fix The vulnerability is fixed in versions 1.6.6 and 1.7.4.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-13250US | high7.5 | — | ||
HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.mdWEB
- https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.mdWEB
- https://github.com/hashicorp/consul/commit/72f92ae7ca4cabc1dc3069362a9b64ef46941432WEB
- https://github.com/hashicorp/consul/pull/8023WEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-13250ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan