Unchecked Return Value in Consul Enterprise and Consul - CVE-2022-40716

Vulnerability identifier: #VU80034

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-40716

CWE-ID: CWE-252

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to an error when handling CSR requests at the RPC endpoint. A remote user with access to a client agent’s mTLS certificate and a valid ACL token for any service within the mesh can send a specially crafted certificate signing request (CSR) to the Consul’s internal RPC endpoint and bypass intended ACL token restrictions.

Consul Enterprise
Consul
Fedora
golang-github-hashicorp-consul-sdk
golang-github-hashicorp-consul-api
moby-engine
IBM Cloud Pak for Watson AIOps

Install updates from vendor's website.

Consul Enterprise - addressed in versions 1.11.9, 1.12.5, 1.13.2
Consul - addressed in versions 1.11.9, 1.12.5, 1.13.2
golang-github-hashicorp-consul-sdk - addressed in versions 0.13.0-1.fc36, 0.13.0-1.fc37
golang-github-hashicorp-consul-api - addressed in versions 1.18.0-1.fc36, 1.18.0-1.fc37
IBM Cloud Pak for Watson AIOps - update to 4.1
moby-engine - addressed in versions 24.0.5-1.fc37, 24.0.5-1.fc38, 24.0.5-1.fc39

• https://discuss.hashicorp.com/t/hcsec-2022-20-consul-service-mesh-intention-bypass-with-malicious-certificate-signing-request/44628

• Security restrictions bypass in HashiCorp Consul
• Fedora 39 update for moby-engine
• Fedora 37 update for moby-engine
• Fedora 38 update for moby-engine
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Fedora 36 update for golang-github-hashicorp-consul-sdk
• Fedora 37 update for golang-github-hashicorp-consul-sdk
• Fedora 37 update for golang-github-hashicorp-consul-api
• Fedora 36 update for golang-github-hashicorp-consul-api