CVE-2022-40716: Medium severity Hashicorp Consul vulnerability
HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."
Other sources
HashiCorp Consul and Consul Enterprise versions prior to 1.11.9, 1.12.5, and 1.13.2 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. A specially crafted CSR sent directly to Consul’s internal server agent RPC endpoint can include multiple SAN URI values with additional service names. This issue has been fixed in versions 1.11.9, 1.12.5, and 1.13.2. There are no known workarounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/hashicorp/consulto a version that resolves this vulnerability.Fixed in 1.13.2 - Upgrade
Upgrade
go/github.com/hashicorp/consulto a version that resolves this vulnerability.Fixed in 1.12.5 - Upgrade
Upgrade
go/github.com/hashicorp/consulto a version that resolves this vulnerability.Fixed in 1.11.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.11.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.12.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.13.2
Event History
Frequently Asked Questions
What is the severity of CVE-2022-40716?
The severity of CVE-2022-40716 is medium with a severity value of 6.5.
How does CVE-2022-40716 affect HashiCorp Consul and Consul Enterprise?
CVE-2022-40716 affects HashiCorp Consul and Consul Enterprise versions prior to 1.11.9, 1.12.5, and 1.13.2.
What is the vulnerability of CVE-2022-40716?
CVE-2022-40716 is a vulnerability that allows bypassing service mesh intentions through a specially crafted CSR.
How can I fix CVE-2022-40716?
To fix CVE-2022-40716, update HashiCorp Consul and Consul Enterprise to version 1.11.9, 1.12.5, or 1.13.2.
Where can I find more information about CVE-2022-40716?
You can find more information about CVE-2022-40716 on the NIST NVD website, the HashiCorp discussions forum, and the GitHub pull request.