1232 matches found
Design/Logic Flaw
HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1...
CVE-2023-3518 JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access
HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1...
CVE-2023-3518
HashiCorp Consul and Consul Enterprise 1.16.0 had a vulnerability in JWT-based service-mesh authentication that allowed or denied access independent of service identities. The issue is fixed in version 1.16.1. No exploitation details are provided in the connected documents. Affected product/versi...
CVE-2023-3518
HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1...
CVE-2023-3518 JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access
HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1...
CVE-2023-3518 JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access
HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1...
PT-2023-25190 · Hashicorp · Hashicorp Consul +1
Name of the Vulnerable Software and Affected Versions: HashiCorp Consul and Consul Enterprise version 1.16.0 Description: A vulnerability was identified in Consul such that using JWT authentication for service mesh incorrectly allows or denies access regardless of service identities...
HashiCorp Consul Security Breach
HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp USA. The product is used to connect and configure applications across dynamically distributed infrastructures. A security vulnerability exists in HashiCorp Consul version 1.16.0 that stems from...
Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers
Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that using JWT authentication for service mesh incorrectly allows/denies access regardless of service identities. This vulnerability, CVE-2023-3518, affects Consul 1.16.0 and was fixed in 1.16.1. Background Consu...
Server-Side Request Forgery (SSRF)
consul is vulnerable to Server-Side Request ForgerySSRF. When the consul client agent follows redirects returned by HTTP health check endpoints an attacker is able to cause SSRF...
Important Photon OS Security Update - PHSA-2023-5.0-0053
Updates of 'consul' packages of Photon OS have been released...
Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
...
Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOps
Summary Multiple vulnerabilities were fixed in IBM Cloud Pak for Watson AIOps version 4.1 Vulnerability Details CVEID:CVE-2021-37219 DESCRIPTION: HashiCorp Consul and Consul Enterprise could allow a remote attacker to gain elevated privileges on the system, caused by a flaw in the Raft RPC layer...
GHSA-H65H-V7FW-4P38 HashiCorp Consul Incorrect Access Control vulnerability
HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured. Specific Go Packages Affected github.com/hashicorp/consul/acl...
HashiCorp Consul Incorrect Access Control vulnerability
HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured. Specific Go Packages Affected github.com/hashicorp/consul/acl...
Insecure Default Configuration
github.com/hashicorp/consul is vulnerable to Insecure Default Configuration. The vulnerability exists because the library does not properly disable the remote proxy patching except AWS Lambda, which allows an attacker with service: write permissions to use Envoy extensions configured via service...
Denial Of Service (DoS)
github.com/hashicorp/consul is vulnerable to Denial Of Service DoS. The vulnerability exists because the peer cluster with a service of the same name as a local service could corrupt the Consul state, resulting in Denial of Service...
GHSA-RQJQ-WW83-WV5C Hashicorp Consul allows user with service:write permissions to patch remote proxy instances
Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the services corresponding to those...
Hashicorp Consul allows user with service:write permissions to patch remote proxy instances
Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the services corresponding to those...
