CVE-2022-38149 HashiCorp Consul Template could reveal Vault secret contents in error messages
Attackers can read Vault secrets via error messages when using Consul Template with incorrect templates, requiring an upgrade to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-38149?
CVE-2022-38149 is a high-severity vulnerability in n/a, published on 17 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.
Weakness: CWE-532
Which versions are affected by CVE-2022-38149?
7 open source packages ship an affected version, including github.com/hashicorp/consul-template. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/consul-template Go | All versions | 0.27.3, 0.28.3, 0.29.2 |
github.com/hashicorp/consul-template Go | All versions | 0.27.3 |
github.com/hashicorp/consul-template Go | All versions | 0.27.3 |
github.com/hashicorp/consul-template Go | From 0.28.0 | 0.28.3 |
github.com/hashicorp/consul-template Go | From 0.28.0 | 0.28.3 |
github.com/hashicorp/consul-template Go | From 0.29.0 | 0.29.2 |
1 more packages
github.com/hashicorp/consul-template Go | From 0.29.0 | 0.29.2 |
Products include Hashicorp Consul Template.
How do I fix CVE-2022-38149?
Upgrade github.com/hashicorp/consul-template to a fixed version for your release line: 0.27.3, 0.28.3 or 0.29.2.
Is CVE-2022-38149 being exploited?
There is no known exploitation of CVE-2022-38149 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2024-TM83377, GHSA-8449-7gc2-pwrp, GO-2022-0980.