GHSA-6hw5-6gcx-phmw
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/hashicorp/consul | >= 1.10.1, < 1.10.2 | 1.10.2 |
| Go | github.com/hashicorp/consul | >= 1.9.0, < 1.9.9 | 1.9.9 |
| Go | github.com/hashicorp/consul | < 1.8.15 | 1.8.15 |
Details
As written in the advisory (Markdown source, shown as plain text).
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2021-38698
- https://github.com/hashicorp/consul/pull/10824
- https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check-on-txn-apply-endpoint/29026
- https://github.com/hashicorp/consul
- https://security.gentoo.org/glsa/202208-09
- https://www.hashicorp.com/blog/category/consul