PT-2020-19874 · Hashicorp+1 · Hashicorp Consul Enterprise+2

Hanshasselberg · Published 2020-01-31 · Updated 2024-08-21 · CVE-2020-7955

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Consul and Consul Enterprise versions 1.4.1 through 1.6.2

Description The issue results from the non-uniform enforcement of Access Control Lists (ACLs) across all API endpoints, potentially leading to unintended information disclosure.

Recommendations For versions 1.4.1 through 1.6.2, update to version 1.6.3 to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2020-3391

ALT-PU-2020-3421

ALT-PU-2022-1256

BIT-CONSUL-2020-7955

CVE-2020-7955

GHSA-R9W6-RHH9-7V53

GO-2022-0874

Affected Products

Alt Linux

Hashicorp Consul Enterprise

Hashicorp Consul

References · 14

• https://hashicorp.com/blog/category/consul · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r9w6-rhh9-7v53 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-consul-2020-7955 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-7955 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-7955 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7955 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0874 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7955 · Security Note
• https://ubuntu.com/security/CVE-2020-7955 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7955 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-7955 · Vendor Advisory
• https://github.com/hashicorp/consul/issues/7160 · Note
• https://t.me/cvenotify/699 · Telegram Post
• https://github.com/advisories/GHSA-r9w6-rhh9-7v53 · Note