CVE-2023-1297
Fixed in a distro release EPSS <1%CVSS 4.9
Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3
Products: HashiCorp Consul, HashiCorp Consul Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/consul | 1.14.5 |
| Go | github.com/hashicorp/consul | 1.15.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | consul-1.15 | 0 |
| Chainguard | consul-1.15-oci-entrypoint | 0 |
| Chainguard | consul-1.15-oci-entrypoint-compat | 0 |
| Chainguard | consul-1.16 | 0 |
| Chainguard | consul-1.16-oci-entrypoint | 0 |
| Chainguard | consul-1.16-oci-entrypoint-compat | 0 |
| Chainguard | consul-1.17 | 0 |
| Chainguard | consul-1.17-fips | 0 |
| Chainguard | consul-1.17-fips-oci-entrypoint | 0 |
| Chainguard | consul-1.17-fips-oci-entrypoint-compat | 0 |
| Chainguard | consul-1.17-oci-entrypoint | 0 |
| Chainguard | consul-1.17-oci-entrypoint-compat | 0 |
| Chainguard | k3d | 5.6.0-r11 |
| Chainguard | k3d-proxy | 5.6.0-r11 |
| Chainguard | k3d-tools | 5.6.0-r11 |
| Ubuntu 18.04 LTS | consul | no fix |
| Ubuntu 20.04 LTS | consul | no fix |
| Ubuntu 22.04 LTS | consul | no fix |
| Wolfi | consul-1.15 | 0 |
| Wolfi | consul-1.15-oci-entrypoint | 0 |
| Wolfi | consul-1.15-oci-entrypoint-compat | 0 |
| Wolfi | consul-1.16 | 0 |
| Wolfi | consul-1.16-oci-entrypoint | 0 |
| Wolfi | consul-1.16-oci-entrypoint-compat | 0 |
| Wolfi | k3d | 5.6.0-r11 |
| Wolfi | k3d-proxy | 5.6.0-r11 |
| Wolfi | k3d-tools | 5.6.0-r11 |