PT-2020-13371 · Hashicorp+1 · Hashicorp Consul Enterprise+2

Published 2020-06-11 · Updated 2024-08-21 · CVE-2020-13170

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Consul and Consul Enterprise versions 1.4.0 through 1.6.5 HashiCorp Consul and Consul Enterprise versions 1.7.0 through 1.7.3

Description The issue arises from the improper enforcement of scope for local tokens issued by a primary data center when replication to a secondary data center is not enabled. This affects the github.com/hashicorp/consul/agent package. The problem is related to improper input validation in HashiCorp Consul.

Recommendations For HashiCorp Consul and Consul Enterprise versions 1.4.0 through 1.6.5, update to version 1.6.6 or later. For HashiCorp Consul and Consul Enterprise versions 1.7.0 through 1.7.3, update to version 1.7.4 or later. As a temporary workaround, consider restricting access to local tokens issued by the primary data center until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2020-3391

ALT-PU-2020-3421

ALT-PU-2022-1256

BIT-CONSUL-2020-13170

CVE-2020-13170

GHSA-P2J5-3F4C-224R

GO-2022-0859

Affected Products

Alt Linux

Hashicorp Consul Enterprise

Hashicorp Consul

References · 16

• https://github.com/hashicorp/consul/pull/8068 · Patch
• https://osv.dev/vulnerability/GHSA-p2j5-3f4c-224r · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13170 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-consul-2020-13170 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0859 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-13170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13170 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13170 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13170 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-13170 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13170 · Vendor Advisory
• https://github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md · Note
• https://github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md · Note
• https://github.com/hashicorp/consul/commit/242994a016a181d6c62a5bb83189716ad13d4216 · Note
• https://t.me/cvenotify/4324 · Telegram Post