modules:
  - module: github.com/hashicorp/consul-template
    versions:
      - fixed: 0.27.3
      - introduced: 0.28.0
        fixed: 0.28.3
      - introduced: 0.29.0
        fixed: 0.29.2
    vulnerable_at: 0.29.1
    packages:
      - package: github.com/hashicorp/consul-template/template
        symbols:
          - Template.Execute
description: |-
    The text of errors returned by Template.Execute can contain Vault secrets,
    potentially revealing these secrets in logs or error reports.
cves:
  - CVE-2022-38149
ghsas:
  - GHSA-8449-7gc2-pwrp
references:
  - advisory: https://discuss.hashicorp.com/t/hsec-2022-16-consul-template-may-expose-vault-secrets-when-processing-invalid-input/43215
  - fix: https://github.com/hashicorp/consul-template/commit/d6a6f4af219c28e67d847ba0e0b2bea8f5bb9076