~ / search / GHSA-8jhx-9gf4-hhf5

GHSA-8jhx-9gf4-hhf5

Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-16377

Packages

EcosystemPackageAffectedFixed in
RubyGems consul < 1.0.3 1.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

With the consul ruby gem before 1.0.3, if a controller checks multiple powers using `:if` or `:except` conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.

References

External links from the advisory. They lead to third-party sites.