CVE-2020-7219

Vulnerability

Details

HashiCorp Consul and Consul Enterprise up to version 1.6.2 contain a vulnerability in their HTTP and RPC services that allows unbounded resource usage [1][2]. An internal security review identified that a Consul server could be overwhelmed by excessive resource consumption when handling many connections, leading to a denial of service condition [2].

Exploitation

Exploitation does not require authentication. Any party with network-level connectivity to a Consul server can launch an attack simply by establishing many unauthenticated HTTP or RPC connections [2]. This generates excessive load, potentially crashing the server and disrupting services [2].

Impact

Successful exploitation affects only availability; confidentiality and data integrity remain intact [2]. However, the denial of service can render the Consul cluster unresponsive, impacting dependent infrastructure.

Mitigation

Upgrading to Consul or Consul Enterprise 1.6.3 or newer resolves the issue [2]. The fix introduces new configuration options such as rpc_max_conns_per_client, rpc_handshake_timeout, http_max_conns_per_client, and https_handshake_timeout to help mitigate resource exhaustion [2].