Input validation error in Consul and Consul Enterprise - CVE-2023-0845
Published: August 28, 2023
Vulnerability identifier: #VU80038
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-0845
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote user with service:write permissions can configure the upstreams to reference a peering destination and crash the Consul server or client agent hosting the xDS connection to an API gateway or ingress gateway.
Affected software
Consul
Consul Enterprise
IBM Cloud Pak for Watson AIOps
Fedora
moby-engine
Consul Enterprise
IBM Cloud Pak for Watson AIOps
Fedora
moby-engine
How to mitigate CVE-2023-0845
Install updates from vendor's website.
Consul - update to 1.14.5
Consul Enterprise - update to 1.14.5
moby-engine - addressed in versions 24.0.5-1.fc37, 24.0.5-1.fc38, 24.0.5-1.fc39
Consul Enterprise - update to 1.14.5
moby-engine - addressed in versions 24.0.5-1.fc37, 24.0.5-1.fc38, 24.0.5-1.fc39