Consul Enterprise Audit Log Bypass for HTTP Events

Summary A vulnerability was identified in Consul Enterprise such that a specially crafted HTTP request can be used to bypass the audit log for HTTP events. This vulnerability, CVE-2021-28156, affects Consul Enterprise versions 1.8.0 up to 1.9.4, and is fixed in the 1.9.5 and 1.8.10 releases...

Consul API KV Endpoint Vulnerable to Cross-Site Scripting

Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that a specially crafted key-value entry could be used to perform a cross-site scripting XSS attack when viewed in Consul KV API’s raw mode. This vulnerability, CVE-2020-25864, affects all Consul versions up to...

FreeBSD : Consul -- Multiple vulnerabilities (093a6baf-9f99-11eb-b150-000c292ee6b8)

Hashicorp reports : Add content-type headers to raw KV responses to prevent XSS attacks CVE-2020-25864. audit-logging: Parse endpoint URL to prevent requests from bypassing the audit log CVE-2021-28156. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

CVE-2021-28156

A flaw was found in the hashicorp consul, where the audit log could be bypassed. The highest threat from this vulnerability is to integrity...

CVE-2020-25864

In consul a specially crafted KV key/value store entry could be used by attacker to perform a XSS Cross Site Scripting attack when viewed in the raw mode...

Hashicorp HashiCorp Consul 安全漏洞

Hashicorp HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp Hashicorp USA. The product is used to connect and configure applications across dynamically distributed infrastructures. A security vulnerability exists in Consul that could allow a...

Important Photon OS Security Update - PHSA-2021-0016

Updates of 'consul' packages of Photon OS have been released...

Vulnerability Scanning With the Metasploit Remote Check Service (Beta Release)

InsightVM and Nexpose customers can now harness the power of the Metasploit community to assess their exposure to the latest threats. The Feb. 3 release of InsightVM and Nexpose version 6.6.63 includes a beta version of the Metasploit Remote Check Service, bringing Metasploit check method...

Photon OS 3.0: Consul PHSA-2021-3.0-0181

An update of the consul package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0181. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid144900;...

Important Photon OS Security Update - PHSA-2021-0181

Updates of 'consul', 'glib' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2021-3.0-0181

Updates of 'glib', 'consul' packages of Photon OS have been released...

CVE-2020-29564

The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password...

CVE-2020-29564

The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password...

Default credentials

The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password...

CVE-2020-29564

The connected Red Hat CVE entry confirms CVE-2020-29564 affecting official Consul Docker images 0.7.1–1.4.2, where a root account has a blank password. Consequently, systems running the affected Consul Docker container may allow a remote attacker to gain root access with no password. The availabl...

CVE-2020-29564

The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password...

HashiCorp Consul Docker images security vulnerability

Hashicorp HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp Hashicorp USA. The product is used to connect and provision applications across dynamically distributed infrastructures. A security vulnerability exists in HashiCorp official Consul...

Privilege Escalation

consul is vulnerable to privilege escalation. The vulnerability exists due to the operators with operator:read ACL permissions are able to read the Consul Connect CA configuration when explicitly configured with the /v1/connect/ca/configuration endpoint including the private key, allowing a...

FreeBSD : consul -- Fix Consul Connect CA private key configuration (8d17229f-3054-11eb-a455-ac1f6b16e566)

Hashicorp reports : Increase the permissions to read from the /connect/ca/configuration endpoint to operator:write. Previously Connect CA configuration, including the private key, set via this endpoint could be read back by an operator with operator:read privileges. C Tenable Network Security, In...

Photon OS 3.0: Consul PHSA-2020-3.0-0163

An update of the consul package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0163. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid143379;...