GitHub Advisoryadvisory · Go

GHSA-6hw5-6gcx-phmw HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.

MEDIUM Published 2021-09-08 Modified 2021-09-16 Official page ↗
Aliases
CVE-2021-38698
Ecosystem
Go
Packages
github.com/hashicorp/consul
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-862, CWE-863
Reviewed
2021-09-08

Affected packages

• Go github.com/hashicorp/consul: >= 1.10.1, < 1.10.2 → fixed in 1.10.2 • Go github.com/hashicorp/consul: >= 1.9.0, < 1.9.9 → fixed in 1.9.9 • Go github.com/hashicorp/consul: < 1.8.15 → fixed in 1.8.15

Description

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.

Related

Alias · CVE (1)

  • CVE-2021-38698 HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access… vulnerability

Weakness · CWE (2)

  • CWE-862 Missing Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References