GitHub Advisoryadvisory · Go

GHSA-m69r-9g56-7mv8 HashiCorp Consul vulnerable to authorization bypass

MEDIUM Published 2022-09-25 Modified 2023-09-06 Official page ↗
Aliases
CVE-2022-40716
Ecosystem
Go
Packages
github.com/hashicorp/consul
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-252
Reviewed
2022-09-29

Affected packages

• Go github.com/hashicorp/consul: < 1.11.9 → fixed in 1.11.9 • Go github.com/hashicorp/consul: >= 1.12.0, < 1.12.5 → fixed in 1.12.5 • Go github.com/hashicorp/consul: >= 1.13.0, < 1.13.2 → fixed in 1.13.2

Description

HashiCorp Consul and Consul Enterprise versions prior to 1.11.9, 1.12.5, and 1.13.2 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. A specially crafted CSR sent directly to Consul’s internal server agent RPC endpoint can include multiple SAN URI values with additional service names. This issue has been fixed in versions 1.11.9, 1.12.5, and 1.13.2. There are no known workarounds.

Related

Alias · CVE (1)

  • CVE-2022-40716 HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal… vulnerability

Weakness · CWE (1)

  • CWE-252 Unchecked Return Value weakness

References