CVE-2022-3920: Consul Peering Imported Nodes/Services Leak
HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HashiCorp Consul and Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.14.0
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-3920.
What is the severity of CVE-2022-3920?
The severity of CVE-2022-3920 is high with a CVSS score of 7.5.
Which software versions are affected by CVE-2022-3920?
HashiCorp Consul and Consul Enterprise versions 1.13.0 up to 1.13.3 are affected by CVE-2022-3920.
How does CVE-2022-3920 affect HashiCorp Consul and Consul Enterprise?
CVE-2022-3920 allows imported nodes and services to be exposed without proper filtering in the UI of HashiCorp Consul and Consul Enterprise versions 1.13.0 up to 1.13.3.
How can I fix CVE-2022-3920?
To fix CVE-2022-3920, update your HashiCorp Consul or Consul Enterprise installation to version 1.14.0 or later.