AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

ConsulGHSA-h65h-v7fw-4p38

HashiCorp Consul Incorrect Access Control vulnerability

Consul

CVE-2019-12291 · Published Jun 9, 2023 · updated Aug 20, 2024

High7.5
Fix: upgrade to 1.5.1 or later
GitHub advisory

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.

Specific Go Packages Affected

github.com/hashicorp/consul/acl

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
>= 1.4.0, < 1.5.11.5.1
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-284
Also known as
CVE-2019-12291, GO-2023-1852

More Consul advisories

All Consul
High 7.5Jan 31, 2024Denial of service in HashiCorp ConsulCVE-2020-25201fixed in 1.7.9 +1High 7.4Aug 9, 2023Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT ProvidersCVE-2023-3518fixed in 1.16.1Medium 4.9Jun 3, 2023Hashicorp Consul vulnerable to denial of serviceCVE-2023-1297fixed in 1.14.5 +1High 8.7Jun 3, 2023Hashicorp Consul allows user with service:write permissions to patch remote proxy instancesCVE-2023-2816fixed in 1.15.3Medium 6.5Mar 9, 2023Consul Server Panic when Ingress and API Gateways Configured with Peering ConnectionsCVE-2023-0845fixed in 1.14.5High 7.5Nov 16, 2022Missing Authorization in HashiCorp ConsulCVE-2022-3920fixed in 1.14.0