GHSA-fhm8-cxcv-pwvc

HashiCorp Consul Access Restriction Bypass

Source: GitHub Advisory Database (reviewed) High CVE-2019-8336

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp/consul	>= 1.4.0, < 1.4.3	1.4.3

Details

As written in the advisory (Markdown source, shown as plain text).

HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "<hidden>" as its secret is used in unusual circumstances.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-8336 advisory
https://github.com/hashicorp/consul/issues/5423 web
https://github.com/hashicorp/consul/commit/90040f8bffb311e6cd8599273e95b607175e311f web
https://github.com/hashicorp/consul package
https://github.com/hashicorp/consul/blob/003370ded024096cd89fb2aa2bc15293c23b9707/agent/consul/leader.go#L405 web