CVE-2022-29153: SSRF
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-29153?
CVE-2022-29153 is a vulnerability in HashiCorp Consul and Consul Enterprise up to versions 1.9.16, 1.10.9, and 1.11.4 that may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints.
How severe is CVE-2022-29153?
CVE-2022-29153 is considered high severity with a CVSS score of 7.5.
How can I fix CVE-2022-29153?
To fix CVE-2022-29153, it is recommended to upgrade to the patched versions: 1.9.17, 1.10.10, or 1.11.5, depending on the version you are using.
Is HashiCorp Consul affected by CVE-2022-29153?
Yes, HashiCorp Consul and Consul Enterprise versions up to 1.9.16, 1.10.9, and 1.11.4 are affected by CVE-2022-29153.
Where can I find more information about CVE-2022-29153?
More information about CVE-2022-29153 can be found on the official HashiCorp forum: [link](https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393)