Authentication Bypass

2022-09-2713:08:32

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

consul

authentication

bypass

vulnerability

uri

length checks

csr requests

attacker

multiple san uri

0.001 Low

EPSS

Percentile

49.8%

JSON

github.com/hashicorp/consul is vulnerable to authentication bypass. The vulnerability exists in auto_config_endpoint.go and leader_connect_ca.go because the URI length checks are not added to CSR requests which allows an attacker to designate multiple SAN URI values in a call to the endpoint.

CPENameOperatorVersion
github.com/hashicorp/consullev1.11.8
github.com/hashicorp/consullev1.12.4
github.com/hashicorp/consullev1.13.1
consul:3.16eq1.12.0-r3
consul:3.16eq1.12.0-r1
consul:3.16eq1.12.0-r4
consul:3.16eq1.12.0-r2
consul:3.16eq1.12.0-r0
consuleq1.9.5-r1
consuleq1.13.1-r0

Name	Operator	Version
github.com/hashicorp/consul	le	v1.11.8
github.com/hashicorp/consul	le	v1.12.4
github.com/hashicorp/consul	le	v1.13.1
consul:3.16	eq	1.12.0-r3
consul:3.16	eq	1.12.0-r1
consul:3.16	eq	1.12.0-r4
consul:3.16	eq	1.12.0-r2
consul:3.16	eq	1.12.0-r0
consul	eq	1.9.5-r1
consul	eq	1.13.1-r0