~ / search / GHSA-hwqm-x785-qh8p

GHSA-hwqm-x785-qh8p

Incorrect Permission Assignment for Critical Resource in Hashicorp Consul

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-12797

Packages

EcosystemPackageAffectedFixed in
Go github.com/hashicorp/consul >= 1.6.0, < 1.6.6 1.6.6
Go github.com/hashicorp/consul >= 1.7.0, < 1.7.4 1.7.4

Details

As written in the advisory (Markdown source, shown as plain text).

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. ### Specific Go Packages Affected github.com/hashicorp/consul/agent/structs

References

External links from the advisory. They lead to third-party sites.