x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-wj6x-hcc2-f32j

[GoVulnBot]

In GitHub Security Advisory GHSA-wj6x-hcc2-f32j, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/hashicorp/consul	1.14.5	>= 1.14.0, < 1.14.5

Cross references:

• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-6hw5-6gcx-phmw #559 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-ccw8-7688-vqx4 #593 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-q6h7-4qgw-2j9p #615 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul/agent/structs: GHSA-hwqm-x785-qh8p #847 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul/agent: GHSA-p2j5-3f4c-224r #859 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul/agent/consul/discoverychain: GHSA-q2qr-3c2p-9235 #861 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-r9w6-rhh9-7v53 #874 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul/agent/config: GHSA-rqjq-mrgx-85hp #879 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-25gf-8qrr-g78r, CVE-2021-32574 #894 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: CVE-2021-36213, GHSA-8h2g-r292-j8xh #895 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: CVE-2022-24687, GHSA-hj93-5fg3-3chr #953 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-m69r-9g56-7mv8 #1029 EFFECTIVELY_PRIVATE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-gw2g-hhc9-wgjh #1121 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/hashicorp/consul
    versions:
      - introduced: 1.14.0
        fixed: 1.14.5
    packages:
      - package: github.com/hashicorp/consul
summary: Consul Server Panic when Ingress and API Gateways Configured with Peering
    Connections
description: A vulnerability was identified in Consul and Consul Enterprise (“Consul”)
    an authenticated user with service:write permissions could trigger a workflow
    that causes Consul server and client agents to crash under certain circumstances.
    To exploit this vulnerability, an attacker requires access to an ACL token with
    service:write permissions, and there needs to be at least one running ingress
    or API gateway that is configured to route traffic to an upstream service.
cves:
  - CVE-2023-0845
ghsas:
  - GHSA-wj6x-hcc2-f32j
references:
  - web: https://nvd.nist.gov/vuln/detail/CVE-2023-0845
  - web: https://discuss.hashicorp.com/t/hcsec-2023-06-consul-server-panic-when-ingress-and-api-gateways-configured-with-peering-connections/51197
  - advisory: https://github.com/advisories/GHSA-wj6x-hcc2-f32j

[gopherbot]

Change https://go.dev/cl/592760 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606783 mentions this issue: data/reports: unexclude 20 reports (3)