CVE-2022-38149: High severity hashicorp consul vulnerability
A vulnerability was found in the HashiCorp Consul Template. This issue may reveal the contents of a Vault secret when used with an invalid template.
Other sources
A vulnerbility was found in Consul Template that may reveal the contents of a Vault secret in errors returned by the (template.Template).Execute method, when a template that uses Vault secret.content incorrectly.
— Red Hat
HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.
In HashiCorp Consul Template through version 0.29.1, invalid templates could inadvertently reveal the contents of Vault secret in errors returned by the template.Template.Execute 5 method, when given a template using Vault secret contents incorrectly. This method has been updated to redact Vault secrets when creating an error string, making it safe to log the error.. This issue was fixed in version 0.29.2.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-38149.
What is the severity of CVE-2022-38149?
The severity of CVE-2022-38149 is high with a CVSS score of 7.5.
Which software versions are affected by CVE-2022-38149?
HashiCorp Consul Template versions up to 0.27.2, 0.28.2, and 0.29.1 are affected by CVE-2022-38149.
How can I fix CVE-2022-38149?
To fix CVE-2022-38149, update HashiCorp Consul Template to version 0.29.2 or higher.
Are there any references available for CVE-2022-38149?
Yes, you can find references for CVE-2022-38149 at the following links: [Reference 1](https://access.redhat.com/errata/RHSA-2023:3742), [Reference 2](https://access.redhat.com/security/cve/cve-2022-38149), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi?id=2119551).