GitHub Advisory DatabaseGHSA-HR3V-8CP3-68RFHashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
6.5 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
59.8%
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/hashicorp/consul | lt | 1.13.2 | |
| github.com/hashicorp/consul | lt | 1.12.5 | |
| github.com/hashicorp/consul | lt | 1.11.9 |
References
discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627
github.com/advisories/GHSA-hr3v-8cp3-68rf
github.com/hashicorp/consul/pull/14577/commits/2c881259ce10e308ff03afc968c4165998fd7fee
lists.fedoraproject.org/archives/list/[email protected]/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC
lists.fedoraproject.org/archives/list/[email protected]/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE
lists.fedoraproject.org/archives/list/[email protected]/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI
nvd.nist.gov/vuln/detail/CVE-2021-41803
Related
7.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
6.5 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
59.8%