Bug 2134570 (CVE-2022-29153) - CVE-2022-29153 consul: Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector
Summary: CVE-2022-29153 consul: Hashicorp Consul HTTP health check endpoints returning...
Keywords:
Status: NEW
Alias: CVE-2022-29153
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2134571 2134572 2134573 2134918 2134919 2134920 2134921 2134922 2134923 2134924 2134925 2138871 2138872 2138873 2138874 2138875 2138876 2138877 2138878 2138879
Blocks: 2134568
TreeView+ depends on / blocked
 
Reported: 2022-10-13 16:22 UTC by Avinash Hanwate
Modified: 2023-10-25 17:21 UTC (History)
16 users (show)

Fixed In Version: consul 1.9.17, consul 1.10.10, consul 1.11.5
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Consul and Consul Enterprise (“Consul”) where HTTP health check endpoints return an HTTP redirect, which can be abused as a vector for server-side request forgery (SSRF).
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Avinash Hanwate 2022-10-13 16:22:34 UTC 
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.

https://discuss.hashicorp.com
https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393
https://security.netapp.com/advisory/ntap-20220602-0005/
https://security.gentoo.org/glsa/202208-09
https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/
Comment 1 Avinash Hanwate 2022-10-13 16:28:25 UTC 
Created golang-github-hashicorp-consul-api tracking bugs for this issue:

Affects: fedora-all [bug 2134571]


Created golang-github-hashicorp-consul-sdk tracking bugs for this issue:

Affects: fedora-all [bug 2134572]


Created moby-engine tracking bugs for this issue:

Affects: fedora-all [bug 2134573]
Note You need to log in before you can comment on or make changes to this bug.