CVE-2020-13250: High severity hashicorp consul vulnerability
HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service.
Specific Go Packages Affected github.com/hashicorp/consul/agent/config
Fix The vulnerability is fixed in versions 1.6.6 and 1.7.4.
Other sources
HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-13250?
CVE-2020-13250 is a vulnerability in HashiCorp Consul and Consul Enterprise that includes an HTTP API and DNS caching feature vulnerable to denial of service.
How severe is CVE-2020-13250?
CVE-2020-13250 has a severity rating of 7.5 (high).
Which versions of HashiCorp Consul are affected by CVE-2020-13250?
Versions between 1.2.0 and 1.7.4 of HashiCorp Consul are affected by CVE-2020-13250.
How can I fix CVE-2020-13250?
To fix CVE-2020-13250, upgrade to version 1.6.6 or 1.7.4 of HashiCorp Consul.
Where can I find more information about CVE-2020-13250?
You can find more information about CVE-2020-13250 on the NIST and GitHub websites. [NIST](https://nvd.nist.gov/vuln/detail/CVE-2020-13250) [GitHub](https://github.com/hashicorp/consul/pull/8023) [GitHub Commit](https://github.com/hashicorp/consul/commit/72f92ae7ca4cabc1dc3069362a9b64ef46941432)