Fedora 36 : containerd / golang-github-containerd-cgroups / moby-engine (2022-db674bafd9)

The remote Fedora 36 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2022-db674bafd9 advisory. golang-github-containerd-cgroups Fix bodhi bug of making epoch version obsolete containerd Update to 1.6.14 rhbz2154183 Tenable has extracted the...

Exploit for Incorrect Authorization in Hashicorp Consul

CVE-2021-41805 Hashicorp Consul RCE via API Has...

Exploit for Incorrect Authorization in Hashicorp Consul

CVE-2021-41805 Hashicorp Consul RCE via API Has...

yokohama-consul.co.jp Cross Site Scripting vulnerability OBB-3069499

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-3920

A flaw was found in the Consul Package. Affected versions of this package are vulnerable to information exposure via the /v1/internal/ui/nodes and /v1/internal/ui/services endpoints for cluster peering, which expose node and service information to unauthenticated attackers...

Information Disclosure

github.com/hashicorp/consul is vulnerable to information disclosure. The vulnerability exists in Filter function of filter.go because the data imported from peers is not properly filtered by ACLs at the UI Nodes which allows an attacker to gain access to the ACL tokens and view sensitive...

GHSA-GW2G-HHC9-WGJH vulnerabilities

Vulnerabilities for packages: consul...

GHSA-GW2G-HHC9-WGJH Missing Authorization in HashiCorp Consul

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

Missing Authorization in HashiCorp Consul

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

GHSA-GW2G-HHC9-WGJH vulnerabilities

Vulnerabilities for packages: consul...

CVE-2022-3920

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

CVE-2022-3920 vulnerabilities

Vulnerabilities for packages: consul...

CVE-2022-3920 vulnerabilities

Vulnerabilities for packages: consul...

Design/Logic Flaw

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

UBUNTU-CVE-2022-3920

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

CVE-2022-3920

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

CVE-2022-3920 Consul Peering Imported Nodes/Services Leak

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

CVE-2022-3920

Summary (CVE-2022-3920) HashiCorp Consul and Consul Enterprise versions 1.13.0–1.13.3 expose information via UI endpoints because cluster filtering does not filter imported nodes and services for HTTP or RPC endpoints. Root cause: inadequate filtering of cluster data used by the UI. Impact: poten...

CVE-2022-3920 Consul Peering Imported Nodes/Services Leak

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...

CVE-2022-3920 Consul Peering Imported Nodes/Services Leak

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0...