Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector
High severity
GitHub Reviewed
Published
Apr 20, 2022
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Package
Affected versions
< 1.9.17
>= 1.10.0, < 1.10.10
>= 1.11.0, < 1.11.5
Patched versions
1.9.17
1.10.10
1.11.5
Description
Published by the National Vulnerability Database
Apr 19, 2022
Published to the GitHub Advisory Database
Apr 20, 2022
Reviewed
Apr 28, 2022
Last updated
Jan 27, 2023
A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that HTTP health check endpoints returning an HTTP redirect may be abused as a vector for server-side request forgery (SSRF). This vulnerability, CVE-2022-29153, was fixed in Consul 1.9.17, 1.10.10, and 1.11.5.
References