ConsulGHSA-hwqm-x785-qh8p
Incorrect Permission Assignment for Critical Resource in Hashicorp Consul
Medium5.3CVE-2020-12797 · Published Jun 23, 2021 · updated Aug 21, 2024
HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. ### Specific Go Packages Affected github.com/hashicorp/consul/agent/structs
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/consul Go | >= 1.6.0, < 1.6.6 | 1.6.6 |
| >= 1.7.0, < 1.7.4 | 1.7.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-732
- Also known as
- BIT-consul-2020-12797, CVE-2020-12797, GO-2022-0847
More Consul advisories
All Consul| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 282021 | Incorrect Authorization in HashiCorp Consul Medium5.3Jul 28, 2021 | Medium5.3 | 1.6.3 |
| Jul 192021 | HashiCorp Consul L7 deny intention results in an allow actionHigh7.5Jul 19, 2021 | High7.5 | 1.10.1 |
| Jul 192021 | Hashicorp Consul Missing SSL Certificate ValidationHigh7.5Jul 19, 2021 | High7.5 | 1.10.1 |
| May 182021 | Allocation of Resources Without Limits or Throttling in Hashicorp ConsulHigh7.5May 18, 2021 | High7.5 | 1.6.6+1 more |
| May 182021 | Improper Input Validation in HashiCorp ConsulMedium5.3May 18, 2021 | Medium5.3 | 1.6.6+1 more |
| May 182021 | Denial of Service (DoS) in HashiCorp ConsulHigh7.5May 18, 2021 | High7.5 | 1.6.3 |