Photon OS 3.0: Consul PHSA-2021-3.0-0279

An update of the consul package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0279. The text itself is copyright C VMware, Inc...

Photon OS 4.0: Consul PHSA-2021-4.0-0075

An update of the consul package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0075. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Important Photon OS Security Update - PHSA-2021-3.0-0279

Updates of 'consul' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2021-0075

Updates of 'consul' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2021-0279

Updates of 'consul' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2021-4.0-0075

Updates of 'consul' packages of Photon OS have been released...

Incorrect Authorization in HashiCorp Consul

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3...

GHSA-R9W6-RHH9-7V53 Incorrect Authorization in HashiCorp Consul

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3...

[ASA-202107-69] consul: multiple issues

Arch Linux Security Advisory ASA-202107-69 ========================================== Severity: Medium Date : 2021-07-27 CVE-ID : CVE-2021-32574 CVE-2021-36213 Package : consul Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2171 Summary ======= The package consul...

HashiCorp Consul L7 deny intention results in an allow action

In HashiCorp Consul before 1.10.1 and Consul Enterprise, xds can generate a situation where a single L7 deny intention with a default deny policy results in an allow action...

GHSA-8H2G-R292-J8XH HashiCorp Consul L7 deny intention results in an allow action

In HashiCorp Consul before 1.10.1 and Consul Enterprise, xds can generate a situation where a single L7 deny intention with a default deny policy results in an allow action...

Hashicorp Consul Missing SSL Certificate Validation

HashiCorp Consul before 1.10.1 and Consul Enterprise has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated...

GHSA-25GF-8QRR-G78R Hashicorp Consul Missing SSL Certificate Validation

HashiCorp Consul before 1.10.1 and Consul Enterprise has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated...

Privilege Escalation

github.com/hashicorp/consul is vulnerable to privilege escalation. The vulnerability exists due to a single L7 deny intention bypassing the default deny policy...

Insecure SSL Certificate Validation

github.com/hashicorp/consul has a missing SSL certificate validation. The vulnerability exists due to the xds not ensuring that the subject Alternative Name of an upstream is validated...

CVE-2021-36213

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1...

CVE-2021-32574

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1...

CVE-2021-32574

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1...

CVE-2021-36213

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1...

DEBIAN-CVE-2021-32574

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1...