CVE-2024-10086
Fixed in a distro release EPSS <1%CVSS 6.1
A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.
Products: HashiCorp Consul, HashiCorp Consul Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/consul | 1.20.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | consul-1.18 | 1.18.2-r44 |
| Chainguard | consul-1.18 | 1.18.2-r48 |
| Chainguard | consul-1.19 | 1.19.2-r47 |
| Chainguard | consul-1.19 | 1.19.2-r43 |
| Chainguard | consul-1.20 | 1.20.6-r11 |
| Chainguard | consul-1.20-oci-entrypoint | 1.20.6-r11 |
| Chainguard | consul-1.20-oci-entrypoint-compat | 1.20.6-r11 |
| Chainguard | consul-1.21 | 1.21.5-r6 |
| Chainguard | consul-1.21-oci-entrypoint | 1.21.5-r6 |
| Chainguard | consul-1.21-oci-entrypoint-compat | 1.21.5-r6 |
| Chainguard | consul-1.22 | 1.22.1-r2 |
| Chainguard | consul-1.22-oci-entrypoint | 1.22.1-r2 |
| Chainguard | consul-1.22-oci-entrypoint-compat | 1.22.1-r2 |
| Chainguard | consul-fips-1.19 | 1.19.2-r42 |
| Chainguard | consul-fips-1.19 | 1.19.2-r47 |
| Chainguard | consul-fips-1.20 | 1.20.6-r10 |
| Chainguard | consul-fips-1.20-oci-entrypoint | 1.20.6-r10 |
| Chainguard | consul-fips-1.20-oci-entrypoint-compat | 1.20.6-r10 |
| Chainguard | consul-fips-1.21 | 1.21.5-r6 |
| Chainguard | consul-fips-1.21-oci-entrypoint | 1.21.5-r6 |
| Chainguard | consul-fips-1.21-oci-entrypoint-compat | 1.21.5-r6 |
| Chainguard | consul-fips-1.22 | 1.22.2-r1 |
| Chainguard | consul-fips-1.22-oci-entrypoint | 1.22.2-r1 |
| Chainguard | consul-fips-1.22-oci-entrypoint-compat | 1.22.2-r1 |
| Debian 11 | consul | no fix |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | govulncheck-vulndb | 0.0.20241104T154416-150000.1.12.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20241104T154416-150000.1.12.1 |
| SUSE Package Hub 12 | govulncheck-vulndb | 0.0.20241104T154416-5.1 |
| Ubuntu 18.04 LTS | consul | no fix |
| Ubuntu 20.04 LTS | consul | no fix |
| Ubuntu 22.04 LTS | consul | no fix |
| openSUSE Leap 15.5 | govulncheck-vulndb | 0.0.20241104T154416-150000.1.12.1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20241104T154416-150000.1.12.1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20241104T154416-1.1 |