Advisoriesby IbisConsulGHSA-hr3v-8cp3-68rf
HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions
Fix: upgrade to 1.11.9 or later (3 fixed versions below)
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/consul Go | >= 1.8.1, < 1.11.9 | 1.11.9 |
| >= 1.12.0, < 1.12.5 | 1.12.5 | |
| >= 1.13.0, < 1.13.2 | 1.13.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-862
- Also known as
- BIT-consul-2021-41803, CVE-2021-41803, GO-2024-2683
- nvd.nist.gov/vuln/detail/CVE-2021-41803
- github.com/hashicorp/consul/pull/14577/commits/2c881259ce10e308ff03afc968c4165998fd7fee
- discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627
- github.com/hashicorp/consul
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI
More Consul advisories
All Consul
Missing Authorization in HashiCorp ConsulCVE-2022-3920fixed in 1.14.0HashiCorp Consul vulnerable to authorization bypassCVE-2022-40716fixed in 1.11.9 +2HashiCorp Consul Cross-site Scripting vulnerabilityCVE-2020-25864fixed in 1.7.14 +2HashiCorp Consul can use cleartext agent-to-agent RPC communicationCVE-2018-19653fixed in 1.4.1HashiCorp Consul vulnerable to Origin Validation ErrorCVE-2019-9764fixed in 1.4.4HashiCorp Consul Access Restriction BypassCVE-2019-8336fixed in 1.4.3