PT-2021-22260 · Hashicorp+3 · Hashicorp Consul Enterprise+4

Published 2021-09-07 · Updated 2024-08-21 · CVE-2021-38698

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Consul and Consul Enterprise version 1.10.1

Description The Txn.Apply endpoint in HashiCorp Consul and Consul Enterprise allowed services to register proxies for other services, enabling access to service traffic.

Recommendations For HashiCorp Consul and Consul Enterprise version 1.10.1, update to version 1.10.2 to resolve the issue. For earlier versions, update to version 1.8.15 or 1.9.9 to resolve the issue. As a temporary workaround, consider restricting access to the Txn.Apply endpoint until a patch is available.

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

ALT-PU-2021-3445

ALT-PU-2023-7106

ALT-PU-2024-8028

BIT-CONSUL-2021-38698

CVE-2021-38698

GHSA-6HW5-6GCX-PHMW

GO-2022-0559

Affected Products

Alt Linux

Astra Linux

Hashicorp Consul Enterprise

Debian

Hashicorp Consul

References · 18

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38698 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-38698 · Security Note
• https://ubuntu.com/security/CVE-2021-38698 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check-on-txn-apply-endpoint/29026 · Vendor Advisory
• https://hashicorp.com/blog/category/consul · Vendor Advisory
• https://security.gentoo.org/glsa/202208-09 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38698 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-38698 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6hw5-6gcx-phmw · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-38698 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-consul-2021-38698 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38698 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0559 · Vendor Advisory
• https://github.com/hashicorp/consul · Note
• https://github.com/hashicorp/consul/pull/10824 · Note