Hashicorp

Consul

33 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.1

CVE-2021-41803

  • EPSS 0.23%
  • Published 23.09.2022 01:15:08
  • Last modified 27.05.2025 16:15:21

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."

7.5

CVE-2022-29153

  • EPSS 87.42%
  • Published 19.04.2022 16:17:10
  • Last modified 21.11.2024 06:58:35

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.

6.5

CVE-2022-24687

  • EPSS 0.44%
  • Published 24.02.2022 16:15:08
  • Last modified 21.11.2024 06:50:52

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9...

8.8

CVE-2021-41805

  • EPSS 6.79%
  • Published 12.12.2021 05:15:07
  • Last modified 21.11.2024 06:26:47

HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a di...

6.5

CVE-2021-38698

  • EPSS 0.69%
  • Published 07.09.2021 12:15:07
  • Last modified 21.11.2024 06:17:55

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.

8.8

CVE-2021-37219

  • EPSS 0.66%
  • Published 07.09.2021 12:15:07
  • Last modified 21.11.2024 06:14:53

HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.

7.5

CVE-2021-36213

  • EPSS 0.77%
  • Published 17.07.2021 18:15:07
  • Last modified 21.11.2024 06:13:19

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1.

7.5

CVE-2021-32574

  • EPSS 1.3%
  • Published 17.07.2021 18:15:07
  • Last modified 21.11.2024 06:07:18

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.

7.5

CVE-2021-28156

  • EPSS 0.53%
  • Published 20.04.2021 16:15:10
  • Last modified 21.11.2024 05:59:12

HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10.

6.1

CVE-2020-25864

  • EPSS 76.79%
  • Published 20.04.2021 16:15:10
  • Last modified 21.11.2024 05:18:56

HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.