CVE-2023-0845
Fixed in a distro release EPSS 1%CVSS 4.9
Consul and Consul Enterprise allowed an authenticated user with service:write permissions to trigger a workflow that causes Consul server and client agents to crash under certain circumstances. This vulnerability was fixed in Consul 1.14.5.
Products: HashiCorp Consul, HashiCorp Consul Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/consul | 1.14.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | consul-1.15 | 1.15.5-r0 |
| Chainguard | consul-1.15-oci-entrypoint | 1.15.5-r0 |
| Chainguard | consul-1.15-oci-entrypoint-compat | 1.15.5-r0 |
| Ubuntu:18.04:LTS | consul | no fix |
| Ubuntu:20.04:LTS | consul | no fix |
| Ubuntu:22.04:LTS | consul | no fix |
| Wolfi | consul-1.15 | 1.15.5-r0 |
| Wolfi | consul-1.15-oci-entrypoint | 1.15.5-r0 |
| Wolfi | consul-1.15-oci-entrypoint-compat | 1.15.5-r0 |