Riskcovery

CVE-2023-1297

Consul Cluster Peering can Result in Denial of Service

State
Published
Severity
4.9 Medium
Published
Jun 2, 2023
Updated
Jan 8, 2025
Reserved
Mar 9, 2023

Read the record on cve.org

Description

Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3

Scores

CVSSScoreVectorSource
3.14.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HHashiCorp

Weaknesses

  • CWE-826 Premature Release of Resource During Expected Lifetime

Affected Products

ProductVersions
ConsulHashiCorp
  • 1.14.0 through 1.14.5Affected
  • 1.15.0 through 1.15.3Affected
Consul EnterpriseHashiCorp
  • 1.14.0 through 1.14.5Affected
  • 1.15.0 through 1.15.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.