Bug 1805866 (CVE-2020-7219) - CVE-2020-7219 consul: HTTP/RPC Services Allow Unbounded Resource Usage
Summary: CVE-2020-7219 consul: HTTP/RPC Services Allow Unbounded Resource Usage
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-7219
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1805867 1805868
Blocks: 1805878
TreeView+ depends on / blocked
 
Reported: 2020-02-21 16:47 UTC by Pedro Sampaio
Modified: 2021-02-16 20:33 UTC (History)
14 users (show)

Fixed In Version: consul 1.6.3
Doc Type: If docs needed, set a value
Doc Text:
An unbound resource consumption vulnerability was found in the API of consul. A remote attacker with a connection to the consul agent servers could abuse this flaw to cause a denial of service (DoS) by repeatedly sending TLS connect attempts over HTTP or RPC, possibly causing an application crash.
Clone Of:
Environment:
Last Closed: 2020-04-07 04:31:50 UTC


Attachments (Terms of Use)

Description Pedro Sampaio 2020-02-21 16:47:45 UTC
HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3.

Upstream issue:

https://github.com/hashicorp/consul/issues/7159

Comment 1 Pedro Sampaio 2020-02-21 16:48:26 UTC
Created consul tracking bugs for this issue:

Affects: epel-6 [bug 1805868]
Affects: fedora-30 [bug 1805867]

Comment 6 Mark Cooper 2020-03-16 01:46:27 UTC
External References:

https://github.com/hashicorp/consul/issues/7159

Comment 8 Mark Cooper 2020-03-17 01:58:54 UTC
Mitigation:

Enforce network connection limits on Consul server agents by using the following iptables rule:
    iptables -A INPUT -p tcp --syn --dport 8300 -m connlimit --connlimit-above 100 -j REJECT --reject-with tcp-reset.

Comment 9 Mark Cooper 2020-03-19 00:59:37 UTC
Working with Kevin, whilst the go.mod file is including consul, it turns out that inside the vendor folder under modules.txt it's only including the API section of code:
    # github.com/hashicorp/consul v1.3.0
    github.com/hashicorp/consul/api

Makes perfect sense that it's only using client api part of consul for compatibility and my bad. Jira tickets are marked rejected/not a bug.

ServiceMesh components are not affected, include consul/api only.

Comment 10 Product Security DevOps Team 2020-04-07 04:31:50 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-7219


Note You need to log in before you can comment on or make changes to this bug.