HIGH8.3
GHSA-5c4w-8hhh-3c3h
Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability
Quick fix
GHSA-5c4w-8hhh-3c3h — github.com/hashicorp/consul: upgrade to the fixed version with the command below.
go get github.com/hashicorp/consul@v1.20.1Details
A vulnerability was identified in Consul and Consul Enterprise ("Consul") such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/hashicorp/consul
Introduced in:
1.9.0Fixed in: 1.20.1Fix
go get github.com/hashicorp/consul@v1.20.1References
- https://nvd.nist.gov/vuln/detail/CVE-2024-10006[ADVISORY]
- https://github.com/hashicorp/consul/pull/21816[WEB]
- https://github.com/hashicorp/consul/commit/d9206fc7e284a9244af4d62f8653a63ca30bd00c[WEB]
- https://discuss.hashicorp.com/t/hcsec-2024-23-consul-l7-intentions-vulnerable-to-headers-bypass[WEB]
- https://github.com/hashicorp/consul[PACKAGE]
- https://security.netapp.com/advisory/ntap-20250110-0005[WEB]