PT-2023-25190 · Hashicorp · Hashicorp Consul+1

Publicado 2023-08-09 · Atualizado 2024-09-26 · CVE-2023-3518

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions HashiCorp Consul and Consul Enterprise version 1.16.0

Description A vulnerability was identified in Consul such that using JWT authentication for service mesh incorrectly allows or denies access regardless of service identities.

Recommendations For HashiCorp Consul and Consul Enterprise version 1.16.0, update to version 1.16.1 to resolve the issue. As a temporary workaround, consider disabling JWT Auth for service mesh until the update is applied.

Correção

Incorrect Privilege Assignment

Improper Authorization

Enumeração de Fraquezas

CWE-266

CWE-285

Identificadores relacionados

BIT-CONSUL-2023-3518

CVE-2023-3518

GHSA-9RHF-Q362-77MX

GO-2024-2704

Produtos afetados

Hashicorp Consul Enterprise

Hashicorp Consul

Referências · 10

• https://github.com/hashicorp/consul · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-3518 · Nota de Segurança
• https://discuss.hashicorp.com/t/hcsec-2023-25-consul-jwt-auth-in-l7-intentions-allow-for-mismatched-service-identity-and-jwt-providers/57004 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-consul-2023-3518 · Aviso do Fabricante
• https://t.me/cibsecurity/68103 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-9rhf-q362-77mx · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2024-2704 · Aviso do Fabricante
• https://github.com/advisories/GHSA-9rhf-q362-77mx · Nota
• https://t.me/cvenotify/96246 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-3518 · Aviso do Fabricante