BIT-consul-2023-3518

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/consul/BIT-consul-2023-3518.json

JSON Data

https://api.test.osv.dev/v1/vulns/BIT-consul-2023-3518

Aliases

Published

2024-03-06T10:51:07.390Z

Modified

2024-11-27T19:40:48.342Z

Summary

[none]

Details

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.

Database specific

{
    "cpes": [
        "cpe:2.3:a:hashicorp:consul:1.16.0:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:hashicorp:consul:1.16.0:-:*:*:-:*:*:*",
        "cpe:2.3:a:hashicorp:consul:1.16.0:rc1:*:*:-:*:*:*"
    ],
    "severity": "High"
}

References

https://discuss.hashicorp.com/t/hcsec-2023-25-consul-jwt-auth-in-l7-intentions-allow-for-mismatched-service-identity-and-jwt-providers/57004

Affected packages

Bitnami / consul

Package

Name: consul
Purl: pkg:bitnami/consul

Severity

7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

1.16.0

Last affected

1.16.0

Introduced

1.16.0-rc1

Last affected

1.16.0-rc1