Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS04NDQ5LTdnYzItcHdycM4AAuFF

HashiCorp Consul Template could reveal Vault secret contents in error messages

In HashiCorp Consul Template through version 0.29.1, invalid templates could inadvertently reveal the contents of Vault secret in errors returned by the *template.Template.Execute 5 method, when given a template using Vault secret contents incorrectly. This method has been updated to redact Vault secrets when creating an error string, making it safe to log the error.. This issue was fixed in version 0.29.2.

Permalink: https://github.com/advisories/GHSA-8449-7gc2-pwrp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04NDQ5LTdnYzItcHdycM4AAuFF
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: about 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-8449-7gc2-pwrp, CVE-2022-38149
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-38149
• https://discuss.hashicorp.com/t/hsec-2022-16-consul-template-may-expose-vault-secrets-when-processing-invalid-input/43215
• https://github.com/hashicorp/consul-template/commit/d6a6f4af219c28e67d847ba0e0b2bea8f5bb9076
• https://pkg.go.dev/vuln/GO-2022-0980
• https://github.com/advisories/GHSA-8449-7gc2-pwrp

Repository: https://github.com/hashicorp/consul-template
Blast Radius: 21.1

Affected Packages