CVE-2022-3920
CVE-2022-3920 · Consul Peering Imported Nodes/Services Leak
This page contains facts from public vulnerability sources. Check the original advisory before updating.
HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.
CVSS 5.3 · Medium · EPSS 0.7%
- Published
- Updated
Stack: system
Affected products and versions
consul
- Versions
- 1.13.0: Affected
- 1.13.1: Affected
- 1.13.2: Affected
- 1.13.3: Affected
No fix published
consul enterprise
- Versions
- 1.13.0: Affected
- 1.13.1: Affected
- 1.13.2: Affected
- 1.13.3: Affected
No fix published
consul Ubuntu:18.04:LTS
- Versions
- 0.6.4~dfsg-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
consul Ubuntu:20.04:LTS
- Versions
- 1.0.7~dfsg1-5ubuntu1
- 1.4.4~dfsg1-2ubuntu2
- 1.5.2+dfsg1-6
- 1.5.2+dfsg1-10
- 1.5.2+dfsg1-12
- 1.5.2+dfsg2-14
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
consul Ubuntu:22.04:LTS
- Versions
- 1.7.4+dfsg1-1
- 1.8.7+dfsg1-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published