CVE-2020-7219: HashiCorp Consul HTTP/RPC Services Denial of Service
Summary
CVE-2020-7219: HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Affects consul versions < 1.6.2. Fixed in 1.6.2. How to fix ↓
Also tracked for
- github.com/hashicorp/consul · Go
- github.com/hashicorp/consul · Go
- consul · Debian:11
The same CVE-2020-7219 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Consul is an open-source service mesh solution that provides a distributed, highly available, and scalable platform for service discovery, configuration, and segmentation across microservices and cloud environments. Consul allows applications to discover and communicate with each other, enabling dynamic service discovery and configuration updates. However, versions up to 1.6.2 of Consul and Consul Enterprise were found to have a vulnerability in their HTTP/RPC services, which allowed unbounded resource usage and made them susceptible to unauthenticated denial of service attacks.
Vulnerability Detail
The vulnerability (CVE-2020-7219) in HashiCorp Consul and Consul Enterprise versions up to 1.6.2 lies in their HTTP/RPC services. These services did not enforce any resource usage limits, allowing an attacker to consume excessive resources on the target system. This could lead to a denial of service condition, causing the affected Consul instance to become unresponsive or crash. The vulnerability can be exploited remotely without authentication, making it a significant security concern for organizations using vulnerable versions of Consul.
How To Fix
Minimum fixed version
1.6.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in HashiCorp Consul and Consul Enterprise versions up to 1.6.2 allows unauthenticated attackers to consume excessive resources, leading to a denial of service condition. To mitigate this risk, it is crucial to upgrade to version 1.6.3 or later of Consul or Consul Enterprise. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for consul →
FAQ
HashiCorp Consul is an open-source service mesh solution that provides service discovery, configuration, and segmentation capabilities for microservices and cloud environments.
The vulnerability allows unauthenticated attackers to consume excessive resources on the target system, leading to a denial of service condition. This can result in the affected Consul instance becoming unresponsive or crashing.
No, the vulnerability can be exploited remotely without authentication.
Versions up to 1.6.2 of HashiCorp Consul and Consul Enterprise are affected.
To protect your Consul deployment, it is recommended to upgrade to version 1.6.3 or later, which includes a fix for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for consul.
