HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.

An update of the telegraf package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request     forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in     1.9.17, 1.10.10, and 1.11.5. (CVE-2022-29153)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request
    forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in
    1.9.17, 1.10.10, and 1.11.5. (CVE-2022-29153)

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2022-7e327a20be advisory.

    ## golang-github-containerd-cgroups

    Fix bodhi bug of making epoch version obsolete

    ## containerd

    Update to 1.6.14 (rhbz#2154183)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the consul package has been released.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-fde38dda12 advisory.

    update to 20.10.22

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2022-db674bafd9 advisory.

    ## golang-github-containerd-cgroups

    Fix bodhi bug of making epoch version obsolete

    ## containerd

    Update to 1.6.14 (rhbz#2154183)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202208-09 (HashiCorp Consul: Multiple Vulnerabilities)

  - HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be     triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5. (CVE-2020-25201)

  - HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to     cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14. (CVE-2020-25864)

  - HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL     permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.
    (CVE-2020-28053)

  - HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted     HTTP events. Fixed in 1.9.5, and 1.8.10. (CVE-2021-28156)

  - HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not     validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and     1.10.1. (CVE-2021-32574)

  - HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7     application-aware intention deny action cancels out, causing the intention to incorrectly fail open,     allowing L4 traffic. Fixed in 1.9.8 and 1.10.1. (CVE-2021-36213)

  - HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for     other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2. (CVE-2021-38698)

  - HashiCorp Consul and Consul Enterprise 1.8.0 through 1.9.14, 1.10.7, and 1.11.2 has Uncontrolled Resource     Consumption. (CVE-2022-24687)

  - HashiCorp Consul and Consul Enterprise through 2022-04-12 allow SSRF. (CVE-2022-29153)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
333780	Photon OS 5.0: Telegraf PHSA-2023-5.0-91-0041	Nessus	PhotonOS Local Security Checks	Local	high
224674	Linux Distros Unpatched Vulnerability : CVE-2022-29153	Nessus	Misc.	Local	high
417928	SCA: security update for github.com/hashicorp/consul (GHSA-q6h7-4qgw-2j9p)	Tenable Cloud Security	SCA Checks	Local	high
417928	SCA: security update for github.com/hashicorp/consul (GHSA-q6h7-4qgw-2j9p)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
211249	Fedora 37 : containerd / golang-github-containerd-cgroups / moby-engine (2022-7e327a20be)	Nessus	Fedora Local Security Checks	Local	high
204388	Photon OS 5.0: Telegraf PHSA-2023-5.0-0041	Nessus	PhotonOS Local Security Checks	Local	high
203937	Photon OS 3.0: Consul PHSA-2023-3.0-0587	Nessus	PhotonOS Local Security Checks	Local	high
203382	Photon OS 4.0: Consul PHSA-2023-4.0-0373	Nessus	PhotonOS Local Security Checks	Local	high
194599	Fedora 37 : moby-engine (2023-fde38dda12)	Nessus	Fedora Local Security Checks	Local	high
169415	Fedora 36 : containerd / golang-github-containerd-cgroups / moby-engine (2022-db674bafd9)	Nessus	Fedora Local Security Checks	Local	high
163985	GLSA-202208-09 : HashiCorp Consul: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high

Detections

Analytics

CVE-2022-29153

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high