Advisoriesby IbisConsulGHSA-p2j5-3f4c-224r
Improper Input Validation in HashiCorp Consul
Fix: upgrade to 1.6.6 or later (2 fixed versions below)
HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.
Specific Go Packages Affected
github.com/hashicorp/consul/agent
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/consul Go | >= 1.6.0-beta1, < 1.6.6 | 1.6.6 |
| >= 1.7.0, < 1.7.4 | 1.7.4 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-20
- Also known as
- BIT-consul-2020-13170, CVE-2020-13170, GO-2022-0859
More Consul advisories
All Consul
Incorrect Authorization in HashiCorp ConsulCVE-2020-7955fixed in 1.6.3HashiCorp Consul L7 deny intention results in an allow actionCVE-2021-36213fixed in 1.10.1Hashicorp Consul Missing SSL Certificate ValidationCVE-2021-32574fixed in 1.10.1Incorrect Permission Assignment for Critical Resource in Hashicorp ConsulCVE-2020-12797fixed in 1.6.6 +1Allocation of Resources Without Limits or Throttling in Hashicorp ConsulCVE-2020-13250fixed in 1.6.6 +1Denial of Service (DoS) in HashiCorp ConsulCVE-2020-7219fixed in 1.6.3