1393 matches found
Important Photon OS Security Update - PHSA-2019-3.0-0017
Updates of 'libtiff', 'wpasupplicant', 'curl', 'openssh', 'consul', 'zookeeper' packages of Photon OS have been released...
PT-2019-12736 · Hashicorp +1 · Hashicorp Consul +1
Name of the Vulnerable Software and Affected Versions: HashiCorp Consul versions 1.4.0 through 1.5.0 Description: The issue is related to Incorrect Access Control in HashiCorp Consul. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that...
Important Photon OS Security Update - PHSA-2019-0017
Updates of 'curl', 'consul', 'wpasupplicant', 'openssh', 'libtiff', 'zookeeper' packages of Photon OS have been released...
Unauthorised Deletion
github.com/Hashicorp/Consul is vulnerable to unauthorised deletion. It does not prevent deletion of a key which is not matching with a prefix if it uses a specific ACL rule for prefix matching in a policy...
Design/Logic Flaw
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verifyserverhostname were set to false, even when it is actually set to true. This is fixed in 1.4.4...
CVE-2019-9764
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verifyserverhostname were set to false, even when it is actually set to true. This is fixed in 1.4.4...
CVE-2019-9764
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verifyserverhostname were set to false, even when it is actually set to true. This is fixed in 1.4.4...
UBUNTU-CVE-2019-9764
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verifyserverhostname were set to false, even when it is actually set to true. This is fixed in 1.4.4...
CVE-2019-9764
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verifyserverhostname were set to false, even when it is actually set to true. This is fixed in 1.4.4...
CVE-2019-9764
CVE-2019-9764 affects HashiCorp Consul 1.4.3, where agent-to-agent TLS does not verify server hostname, making it behave as if verify_server_hostname were false. This can impact confidentiality and integrity (per CVSS metadata). The issue is fixed in 1.4.4; remediation is to upgrade to 1.4.4 or l...
CVE-2019-9764
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verifyserverhostname were set to false, even when it is actually set to true. This is fixed in 1.4.4...
CVE-2019-9764
Removed by vendor...
PT-2019-19855 · Hashicorp +1 · Hashicorp Consul +1
Name of the Vulnerable Software and Affected Versions: HashiCorp Consul version 1.4.3 Description: The issue arises from a lack of server hostname verification for agent-to-agent TLS communication in HashiCorp Consul. This occurs even when the verify server hostname setting is set to true, causin...
CVE-2019-9764: Origin Validation Error
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verifyserverhostname were set to false, even when it is actually set to true. This is fixed in 1.4.4...
Privilege Escalation
github.com/hashicorp/consul is vulnerable to privilege escalation. In an unusual circumstance, a client is able to bypass access restrictions to obtain higher privileges within secondary datacenters using a secret token...
CVE-2019-8336
HashiCorp Consul and Consul Enterprise 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "" as its secret is used in unusual circumstances...
CVE-2019-8336
HashiCorp Consul and Consul Enterprise 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "" as its secret is used in unusual circumstances...
CVE-2019-8336
HashiCorp Consul and Consul Enterprise 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "" as its secret is used in unusual circumstances...
Security feature bypass
HashiCorp Consul and Consul Enterprise 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "" as its secret is used in unusual circumstances...