AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ConsulGHSA-r9w6-rhh9-7v53

Incorrect Authorization in HashiCorp Consul

Consul

CVE-2020-7955 · Published Jul 28, 2021 · updated Aug 21, 2024

Medium5.3
Fix: upgrade to 1.6.3 or later
GitHub advisory

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
>= 1.4.1, < 1.6.31.6.3
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-863
Also known as
BIT-consul-2020-7955, CVE-2020-7955, GO-2022-0874

More Consul advisories

All Consul
Medium 6.5Sep 8, 2021Consul: missing authorizationCVE-2021-38698fixed in 1.8.15 +2High 8.8Sep 8, 2021HashiCorp Consul Privilege Escalation VulnerabilityCVE-2021-37219fixed in 1.8.15 +2High 7.5Jul 19, 2021HashiCorp Consul L7 deny intention results in an allow actionCVE-2021-36213fixed in 1.10.1High 7.5Jul 19, 2021Hashicorp Consul Missing SSL Certificate ValidationCVE-2021-32574fixed in 1.10.1Medium 5.3Jun 23, 2021Incorrect Permission Assignment for Critical Resource in Hashicorp ConsulCVE-2020-12797fixed in 1.6.6 +1High 7.5May 18, 2021Allocation of Resources Without Limits or Throttling in Hashicorp ConsulCVE-2020-13250fixed in 1.6.6 +1