ConsulGHSA-p2j5-3f4c-224r
Improper Input Validation in HashiCorp Consul
Medium5.3CVE-2020-13170 · Published May 18, 2021 · updated Aug 21, 2024
HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. ### Specific Go Packages Affected github.com/hashicorp/consul/agent
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/consul Go | >= 1.6.0-beta1, < 1.6.6 | 1.6.6 |
| >= 1.7.0, < 1.7.4 | 1.7.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-20
- Also known as
- BIT-consul-2020-13170, CVE-2020-13170, GO-2022-0859
More Consul advisories
All Consul| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 282021 | Incorrect Authorization in HashiCorp Consul Medium5.3Jul 28, 2021 | Medium5.3 | 1.6.3 |
| Jul 192021 | HashiCorp Consul L7 deny intention results in an allow actionHigh7.5Jul 19, 2021 | High7.5 | 1.10.1 |
| Jul 192021 | Hashicorp Consul Missing SSL Certificate ValidationHigh7.5Jul 19, 2021 | High7.5 | 1.10.1 |
| Jun 232021 | Incorrect Permission Assignment for Critical Resource in Hashicorp ConsulMedium5.3Jun 23, 2021 | Medium5.3 | 1.6.6+1 more |
| May 182021 | Allocation of Resources Without Limits or Throttling in Hashicorp ConsulHigh7.5May 18, 2021 | High7.5 | 1.6.6+1 more |
| May 182021 | Denial of Service (DoS) in HashiCorp ConsulHigh7.5May 18, 2021 | High7.5 | 1.6.3 |