PT-2020-13271 · Hashicorp+1 · Hashicorp Consul Enterprise+2

Hanshasselberg · Published 2020-06-11 · Updated 2024-08-21 · CVE-2020-12797

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Consul and Consul Enterprise versions 1.4.0 through 1.6.5 HashiCorp Consul and Consul Enterprise versions 1.7.0 through 1.7.3

Description The issue arises from HashiCorp Consul and Consul Enterprise failing to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. This was introduced in version 1.4.0.

Recommendations For versions 1.4.0 through 1.6.5, update to version 1.6.6 or later. For versions 1.7.0 through 1.7.3, update to version 1.7.4 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

ALT-PU-2020-3391

ALT-PU-2020-3421

ALT-PU-2022-1256

BIT-CONSUL-2020-12797

CVE-2020-12797

GHSA-HWQM-X785-QH8P

GO-2022-0847

Affected Products

Alt Linux

Hashicorp Consul Enterprise

Hashicorp Consul

References · 17

• https://github.com/hashicorp/consul/pull/8047 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-12797 · Security Note
• https://osv.dev/vulnerability/GHSA-hwqm-x785-qh8p · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0847 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12797 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-12797 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-consul-2020-12797 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12797 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-12797 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-12797 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-12797 · Vendor Advisory
• https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md · Note
• https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md · Note
• https://github.com/hashicorp/consul/issues/5606 · Note
• https://github.com/hashicorp/consul/commit/98eea08d3ba1b220a14cf6eedf3b6b07ae2795d7 · Note