CVE-2022-29153: SSRF
First published: Tue Apr 19 2022(Updated: )
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HashiCorp Consul | <1.9.17 | |
| HashiCorp Consul | <1.9.17 | |
| HashiCorp Consul | >=1.10.0<1.10.10 | |
| HashiCorp Consul | >=1.10.0<1.10.10 | |
| HashiCorp Consul | >=1.11.0<1.11.5 | |
| HashiCorp Consul | >=1.11.0<1.11.5 | |
| Fedoraproject Fedora | =37 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://discuss.hashicorp.com
- https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/
- https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBODKZL7HQE5XXS3SA2VIDVL4LAA5RWH/
- https://security.gentoo.org/glsa/202208-09
- https://security.netapp.com/advisory/ntap-20220602-0005/
Frequently Asked Questions
What is CVE-2022-29153?
CVE-2022-29153 is a vulnerability in HashiCorp Consul and Consul Enterprise up to versions 1.9.16, 1.10.9, and 1.11.4 that may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints.
How severe is CVE-2022-29153?
CVE-2022-29153 is considered high severity with a CVSS score of 7.5.
How can I fix CVE-2022-29153?
To fix CVE-2022-29153, it is recommended to upgrade to the patched versions: 1.9.17, 1.10.10, or 1.11.5, depending on the version you are using.
Is HashiCorp Consul affected by CVE-2022-29153?
Yes, HashiCorp Consul and Consul Enterprise versions up to 1.9.16, 1.10.9, and 1.11.4 are affected by CVE-2022-29153.
Where can I find more information about CVE-2022-29153?
More information about CVE-2022-29153 can be found on the official HashiCorp forum: [link](https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393)
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/hashicorp
- canonical/hashicorp consul
- version/hashicorp consul/1.10.0
- version/hashicorp consul/1.11.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/37