PT-2022-11486 · Hashicorp+3 · Hashicorp Consul+3

Published 2022-09-22 · Updated 2025-04-02 · CVE-2021-41803

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions HashiCorp Consul versions 1.8.1 through 1.11.8 HashiCorp Consul version 1.12.4 HashiCorp Consul version 1.13.1

Description The issue arises from improper validation of node or segment names prior to their interpolation and usage in JWT claim assertions with the auto config RPC. This could potentially lead to security issues, although specific details about the estimated number of affected devices or real-world incidents are not provided.

Recommendations For HashiCorp Consul versions 1.8.1 through 1.11.8, update to version 1.11.9 or later. For HashiCorp Consul version 1.12.4, update to version 1.12.5 or later. For HashiCorp Consul version 1.13.1, update to version 1.13.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

ALT-PU-2023-1696

ALT-PU-2023-7106

ALT-PU-2024-8028

BDU:2025-04574

BIT-CONSUL-2021-41803

CVE-2021-41803

GHSA-HR3V-8CP3-68RF

GO-2024-2683

Affected Products

Alt Linux

Debian

Hashicorp Consul

Red Os

References · 27

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-41803 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-41803 · Security Note
• https://hashicorp.com/blog/category/consul · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41803 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hr3v-8cp3-68rf · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04574 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-41803 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41803 · Security Note
• https://osv.dev/vulnerability/GO-2024-2683 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI · Vendor Advisory