CVE-2022-29153: SSRF
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HashiCorp Consul and Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.9.17 - Upgrade
Upgrade
HashiCorp Consul and Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.10.10 - Upgrade
Upgrade
HashiCorp Consul and Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.11.5
Event History
Frequently Asked Questions
What is CVE-2022-29153?
CVE-2022-29153 is a vulnerability in HashiCorp Consul and Consul Enterprise up to versions 1.9.16, 1.10.9, and 1.11.4 that may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints.
How severe is CVE-2022-29153?
CVE-2022-29153 is considered high severity with a CVSS score of 7.5.
How can I fix CVE-2022-29153?
To fix CVE-2022-29153, it is recommended to upgrade to the patched versions: 1.9.17, 1.10.10, or 1.11.5, depending on the version you are using.
Is HashiCorp Consul affected by CVE-2022-29153?
Yes, HashiCorp Consul and Consul Enterprise versions up to 1.9.16, 1.10.9, and 1.11.4 are affected by CVE-2022-29153.
Where can I find more information about CVE-2022-29153?
More information about CVE-2022-29153 can be found on the official HashiCorp forum: [link](https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393)