AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

ConsulGHSA-fhm8-cxcv-pwvc

HashiCorp Consul Access Restriction Bypass

Consul

CVE-2019-8336 · Published May 13, 2022 · updated Aug 20, 2024

High8.1
Fix: upgrade to 1.4.3 or later
GitHub advisory

HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "<hidden>" as its secret is used in unusual circumstances.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
>= 1.4.0, < 1.4.31.4.3
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-284
Also known as
CVE-2019-8336, GO-2023-1945

More Consul advisories

All Consul
Medium 6.1May 24, 2022HashiCorp Consul Cross-site Scripting vulnerabilityCVE-2020-25864fixed in 1.7.14 +2Medium 5.9May 14, 2022HashiCorp Consul can use cleartext agent-to-agent RPC communicationCVE-2018-19653fixed in 1.4.1High 7.4May 13, 2022HashiCorp Consul vulnerable to Origin Validation ErrorCVE-2019-9764fixed in 1.4.4High 7.5Apr 20, 2022Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vectorCVE-2022-29153fixed in 1.9.17 +2Medium 6.5Feb 25, 2022HashiCorp Consul Ingress Gateway Panic Can Shutdown ServersCVE-2022-24687fixed in 1.9.15 +2Medium 5.3Feb 15, 2022Denial of Service (DoS) in HashiCorp ConsulCVE-2020-12758fixed in 1.6.6 +1