PT-2020-16913 · Hashicorp+1 · Hashicorp Consul Enterprise+2

Published 2020-11-23 · Updated 2024-06-28 · CVE-2020-28053

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Consul and Consul Enterprise versions 1.2.0 through 1.8.5

Description The issue allows operators with operator:read ACL permissions to read the Connect CA private key configuration. This is a problem of privilege escalation.

Recommendations For versions 1.2.0 through 1.5.9, update to version 1.6.10. For versions 1.6.0 through 1.7.9, update to version 1.7.10. For versions 1.8.0 through 1.8.5, update to version 1.8.6.

Fix

Incorrect Authorization

Incorrect Permission

Weakness Enumeration

CWE-863

CWE-732

Related Identifiers

ALT-PU-2020-3391

ALT-PU-2020-3421

ALT-PU-2022-1256

BIT-CONSUL-2020-28053

CVE-2020-28053

GHSA-6M72-467W-94RH

GO-2024-2505

Affected Products

Alt Linux

Hashicorp Consul Enterprise

Hashicorp Consul

References · 18

• https://osv.dev/vulnerability/DEBIAN-CVE-2020-28053 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-09 · Vendor Advisory
• https://hashicorp.com/blog/category/consul · Vendor Advisory
• https://osv.dev/vulnerability/BIT-consul-2020-28053 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2505 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-28053 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28053 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28053 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6m72-467w-94rh · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-28053 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-28053 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-28053 · Vendor Advisory
• https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#186-november-19-2020 · Note
• https://github.com/hashicorp/consul/pull/9240 · Note
• https://github.com/hashicorp/consul/issues/9240 · Note