PT-2019-18973 · Hashicorp+1 · Hashicorp Consul+2

Mkeeler · Publicado 2019-03-05 · Atualizado 2024-08-20 · CVE-2019-8336

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Consul (and Consul Enterprise) versions 1.4.0 through 1.4.2

Description The issue allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters. This occurs because a token with literally "" as its secret is used in unusual circumstances.

Recommendations For HashiCorp Consul (and Consul Enterprise) versions 1.4.0 through 1.4.2, update to version 1.4.3 or later to resolve the issue.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

ALT-PU-2019-1446

CVE-2019-8336

GHSA-FHM8-CXCV-PWVC

GO-2023-1945

Produtos afetados

Alt Linux

Hashicorp Consul Enterprise

Hashicorp Consul

Referências · 9

• https://github.com/hashicorp/consul · Nota
• https://github.com/hashicorp/consul/issues/5423 · Nota
• https://github.com/hashicorp/consul/blob/003370ded024096cd89fb2aa2bc15293c23b9707/agent/consul/leader.go#L405 · Nota
• https://github.com/hashicorp/consul/commit/90040f8bffb311e6cd8599273e95b607175e311f · Nota
• https://osv.dev/vulnerability/GHSA-fhm8-cxcv-pwvc · Aviso do Fabricante
• https://github.com/advisories/GHSA-fhm8-cxcv-pwvc · Nota
• https://osv.dev/vulnerability/CVE-2019-8336 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2023-1945 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-8336 · Nota de Segurança