HIGH 7.1
GHSA-hr3v-8cp3-68rf
HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions
Quick fix
GHSA-hr3v-8cp3-68rf — github.com/hashicorp/consul: upgrade to the fixed version with the command below.
go get github.com/hashicorp/consul@v1.11.9Details
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/hashicorp/consul
Introduced in:
1.8.1 Fixed in: 1.11.9 Fix
go get github.com/hashicorp/consul@v1.11.9 Go / github.com/hashicorp/consul
Introduced in:
1.12.0 Fixed in: 1.12.5 Fix
go get github.com/hashicorp/consul@v1.12.5 Go / github.com/hashicorp/consul
Introduced in:
1.13.0 Fixed in: 1.13.2 Fix
go get github.com/hashicorp/consul@v1.13.2 References
- https://nvd.nist.gov/vuln/detail/CVE-2021-41803 [ADVISORY]
- https://github.com/hashicorp/consul/pull/14577/commits/2c881259ce10e308ff03afc968c4165998fd7fee [WEB]
- https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627 [WEB]
- https://github.com/hashicorp/consul [PACKAGE]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC [WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE [WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI [WEB]