Bug 1805866 (CVE-2020-7219) - CVE-2020-7219 consul: HTTP/RPC Services Allow Unbounded Resource Usage
Summary: CVE-2020-7219 consul: HTTP/RPC Services Allow Unbounded Resource Usage
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-7219
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1805867 1805868
Blocks: 1805878
TreeView+ depends on / blocked
 
Reported: 2020-02-21 16:47 UTC by Pedro Sampaio
Modified: 2021-02-16 20:33 UTC (History)
14 users (show)

Fixed In Version: consul 1.6.3
Clone Of:
Environment:
Last Closed: 2020-04-07 04:31:50 UTC
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2020-02-21 16:47:45 UTC 
HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3.

Upstream issue:

https://github.com/hashicorp/consul/issues/7159
Comment 1 Pedro Sampaio 2020-02-21 16:48:26 UTC 
Created consul tracking bugs for this issue:

Affects: epel-6 [bug 1805868]
Affects: fedora-30 [bug 1805867]
Comment 6 Mark Cooper 2020-03-16 01:46:27 UTC 
External References:

https://github.com/hashicorp/consul/issues/7159
Comment 8 Mark Cooper 2020-03-17 01:58:54 UTC 
Mitigation:

Enforce network connection limits on Consul server agents by using the following iptables rule:
    iptables -A INPUT -p tcp --syn --dport 8300 -m connlimit --connlimit-above 100 -j REJECT --reject-with tcp-reset.
Comment 9 Mark Cooper 2020-03-19 00:59:37 UTC 
Working with Kevin, whilst the go.mod file is including consul, it turns out that inside the vendor folder under modules.txt it's only including the API section of code:
    # github.com/hashicorp/consul v1.3.0
    github.com/hashicorp/consul/api

Makes perfect sense that it's only using client api part of consul for compatibility and my bad. Jira tickets are marked rejected/not a bug.

ServiceMesh components are not affected, include consul/api only.
Comment 10 Product Security DevOps Team 2020-04-07 04:31:50 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-7219
Note You need to log in before you can comment on or make changes to this bug.