GHSA-rqjq-ww83-wv5c
Hashicorp Consul allows user with service:write permissions to patch remote proxy instances
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/hashicorp/consul | >= 1.15.0, < 1.15.3 | 1.15.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.
References
External links from the advisory. They lead to third-party sites.