GHSA-hr3v-8cp3-68rf
Suggest an improvement- Source
- https://github.com/advisories/GHSA-hr3v-8cp3-68rf
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-hr3v-8cp3-68rf/GHSA-hr3v-8cp3-68rf.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-hr3v-8cp3-68rf
- Aliases
- Related
- Published
- 2022-09-25T00:00:15Z
- Modified
- 2024-04-22T19:08:30Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H CVSS Calculator
- Summary
- HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions
- Details
-
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.
- Database specific
{ "nvd_published_at": "2022-09-23T01:15:00Z", "cwe_ids": [ "CWE-862" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-04-02T20:30:12Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2021-41803
- https://github.com/hashicorp/consul/pull/14577/commits/2c881259ce10e308ff03afc968c4165998fd7fee
- https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627
- https://github.com/hashicorp/consul
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI
Affected packages
Go / github.com/hashicorp/consul
Package
- Name
- github.com/hashicorp/consul
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/hashicorp/consul
Go / github.com/hashicorp/consul
Package
- Name
- github.com/hashicorp/consul
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/hashicorp/consul
Go / github.com/hashicorp/consul
Package
- Name
- github.com/hashicorp/consul
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/hashicorp/consul