GitHub Advisoryadvisory · Go

GHSA-hr3v-8cp3-68rf HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions

HIGH Published 2022-09-25 Modified 2024-04-22 Official page ↗
Aliases
CVE-2021-41803
Ecosystem
Go
Packages
github.com/hashicorp/consul
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Weaknesses
CWE-862
Reviewed
2024-04-02

Affected packages

• Go github.com/hashicorp/consul: >= 1.8.1, < 1.11.9 → fixed in 1.11.9 • Go github.com/hashicorp/consul: >= 1.12.0, < 1.12.5 → fixed in 1.12.5 • Go github.com/hashicorp/consul: >= 1.13.0, < 1.13.2 → fixed in 1.13.2

Description

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.

Related

Alias · CVE (1)

  • CVE-2021-41803 HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References