AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

ConsulGHSA-6m72-467w-94rh

Privilege Escalation in HashiCorp Consul

Consul

CVE-2020-28053 · Published Jan 31, 2024 · updated Jun 28, 2024

Medium6.5
Fix: upgrade to 1.6.10 or later (3 fixed versions below)
GitHub advisory

HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
>= 1.2.0, < 1.6.101.6.10
>= 1.7.0, < 1.7.101.7.10
>= 1.8.0, < 1.8.61.8.6
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-732, CWE-863
Also known as
BIT-consul-2020-28053, CVE-2020-28053, GO-2024-2505

More Consul advisories

All Consul
High 8.1Oct 31, 2024Hashicorp Consul Path Traversal vulnerabilityCVE-2024-10005fixed in 1.20.1High 7.5Jan 31, 2024Denial of service in HashiCorp ConsulCVE-2020-25201fixed in 1.7.9 +1High 7.4Aug 9, 2023Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT ProvidersCVE-2023-3518fixed in 1.16.1High 7.5Jun 9, 2023HashiCorp Consul Incorrect Access Control vulnerabilityCVE-2019-12291fixed in 1.5.1Medium 4.9Jun 3, 2023Hashicorp Consul vulnerable to denial of serviceCVE-2023-1297fixed in 1.14.5 +1High 8.7Jun 3, 2023Hashicorp Consul allows user with service:write permissions to patch remote proxy instancesCVE-2023-2816fixed in 1.15.3