AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ConsulGHSA-hwqm-x785-qh8p

Incorrect Permission Assignment for Critical Resource in Hashicorp Consul

Consul

CVE-2020-12797 · Published Jun 23, 2021 · updated Aug 21, 2024

Medium5.3
Fix: upgrade to 1.6.6 or later (2 fixed versions below)
GitHub advisory

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.

Specific Go Packages Affected

github.com/hashicorp/consul/agent/structs

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
>= 1.6.0, < 1.6.61.6.6
>= 1.7.0, < 1.7.41.7.4
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-732
Also known as
BIT-consul-2020-12797, CVE-2020-12797, GO-2022-0847

More Consul advisories

All Consul
Medium 5.3Jul 28, 2021Incorrect Authorization in HashiCorp ConsulCVE-2020-7955fixed in 1.6.3High 7.5Jul 19, 2021HashiCorp Consul L7 deny intention results in an allow actionCVE-2021-36213fixed in 1.10.1High 7.5Jul 19, 2021Hashicorp Consul Missing SSL Certificate ValidationCVE-2021-32574fixed in 1.10.1High 7.5May 18, 2021Allocation of Resources Without Limits or Throttling in Hashicorp ConsulCVE-2020-13250fixed in 1.6.6 +1Medium 5.3May 18, 2021Improper Input Validation in HashiCorp ConsulCVE-2020-13170fixed in 1.6.6 +1High 7.5May 18, 2021Denial of Service (DoS) in HashiCorp ConsulCVE-2020-7219fixed in 1.6.3