~ / search / GHSA-9rhf-q362-77mx

GHSA-9rhf-q362-77mx

Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers

Source: GitHub Advisory Database (reviewed) High CVE-2023-3518

Packages

EcosystemPackageAffectedFixed in
Go github.com/hashicorp/consul >= 1.16.0, < 1.16.1 1.16.1

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was identified in Consul such that using JWT authentication for service mesh incorrectly allows/denies access regardless of service identities. This vulnerability, CVE-2023-3518, affects Consul 1.16.0 and was fixed in 1.16.1.

References

External links from the advisory. They lead to third-party sites.