GO-2022-0980
Dashboard / Vulnerabilities / GO-2022-0980
GO-2022-0980
Published: 21 Sept 2022Last Modified: 20 May 2024
Aliases:
Summary: Exposure of Vault secrets via error messages in github.com/hashicorp/consul-template
Details: The text of errors returned by Template.Execute can contain Vault secrets, potentially revealing these secrets in logs or error reports.
References: https://discuss.hashicorp.com/t/hsec-2022-16-consul-template-may-expose-vault-secrets-when-processing-invalid-input/43215, https://github.com/hashicorp/consul-template/commit/d6a6f4af219c28e67d847ba0e0b2bea8f5bb9076
Affected packages
Package
Name: github.com/hashicorp/consul-template
Purl: pkg:golang/github.com/hashicorp/consul-template
Affected ranges
Type: SEMVER
Events:
Introduced- 0
Fixed -0.27.3
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
