GHSA-5c4w-8hhh-3c3h

Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-10006

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp/consul	>= 1.9.0, < 1.20.1	1.20.1

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was identified in Consul and Consul Enterprise ("Consul") such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-10006 advisory
https://github.com/hashicorp/consul/pull/21816 web
https://github.com/hashicorp/consul/commit/d9206fc7e284a9244af4d62f8653a63ca30bd00c web
https://discuss.hashicorp.com/t/hcsec-2024-23-consul-l7-intentions-vulnerable-to-headers-bypass web
https://github.com/hashicorp/consul package
https://security.netapp.com/advisory/ntap-20250110-0005 web