CVE-2022-3920
Fixed in a distro release EPSS <1%CVSS 5.3
HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.
Products: HashiCorp Consul, HashiCorp Consul Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/consul | 1.14.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | consul-1.15 | 1.15.5-r0 |
| Chainguard | consul-1.15-oci-entrypoint | 1.15.5-r0 |
| Chainguard | consul-1.15-oci-entrypoint-compat | 1.15.5-r0 |
| Ubuntu 18.04 LTS | consul | no fix |
| Ubuntu 20.04 LTS | consul | no fix |
| Ubuntu 22.04 LTS | consul | no fix |
| Wolfi | consul-1.15 | 1.15.5-r0 |
| Wolfi | consul-1.15-oci-entrypoint | 1.15.5-r0 |
| Wolfi | consul-1.15-oci-entrypoint-compat | 1.15.5-r0 |