CVE-2021-41803
- Source
- https://cve.org/CVERecord?id=CVE-2021-41803
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-41803.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-41803
- Aliases
- Downstream
- Related
- Published
- 2022-09-23T01:15:08.623Z
- Modified
- 2026-07-09T00:37:14.691444Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."
- References
-
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/
- https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627
- https://www.hashicorp.com/blog/category/consul
Affected packages
Git / github.com/hashicorp/consul
Affected ranges
- Type
- GIT
- Repo
- https://github.com/hashicorp/consul
- Events
-
IntroducedFixedIntroducedLast affected
- Database specific
{ "cpe": [ "cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*", "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*", "cpe:2.3:a:hashicorp:consul:1.12.4:*:*:*:-:*:*:*", "cpe:2.3:a:hashicorp:consul:1.12.4:*:*:*:enterprise:*:*:*", "cpe:2.3:a:hashicorp:consul:1.13.1:*:*:*:-:*:*:*", "cpe:2.3:a:hashicorp:consul:1.13.1:*:*:*:enterprise:*:*:*" ], "extracted_events": [ { "introduced": "1.8.1" }, { "fixed": "1.11.9" }, { "introduced": "1.12.4" }, { "last_affected": "1.12.4" }, { "introduced": "1.13.1" }, { "last_affected": "1.13.1" } ], "source": [ "CPE_RANGE", "CPE_STRING" ] }