[pkg-go] Bug#973892: consul: CVE-2020-25201

[Salvatore Bonaccorso]

Source: consul
Version: 1.7.4+dfsg1-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/hashicorp/consul/pull/9024
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for consul.

I'm not particularly familiar with consul, but just skimmed over the
current sources in unstable.

CVE-2020-25201[0]:
| HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a
| namespace replication bug which can be triggered to cause denial of
| service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-25201
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25201
[1] https://github.com/hashicorp/consul/pull/9024

Regards,
Salvatore