Lucene search

K
osvGoogleOSV:GHSA-HWQM-X785-QH8P
HistoryJun 23, 2021 - 5:52 p.m.

Incorrect Permission Assignment for Critical Resource in Hashicorp Consul

2021-06-2317:52:33
Google
osv.dev
5

5.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.6%

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.

Specific Go Packages Affected

github.com/hashicorp/consul/agent/structs

5.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.6%