MEDIUM6.5
GHSA-6hw5-6gcx-phmw
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.
Quick fix
GHSA-6hw5-6gcx-phmw — github.com/hashicorp/consul: upgrade to the fixed version with the command below.
go get github.com/hashicorp/consul@v1.10.2Details
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/hashicorp/consul
Introduced in:
1.10.1Fixed in: 1.10.2Fix
go get github.com/hashicorp/consul@v1.10.2Go/github.com/hashicorp/consul
Introduced in:
1.9.0Fixed in: 1.9.9Fix
go get github.com/hashicorp/consul@v1.9.9Go/github.com/hashicorp/consul
Introduced in:
0Fixed in: 1.8.15Fix
go get github.com/hashicorp/consul@v1.8.15References
- https://nvd.nist.gov/vuln/detail/CVE-2021-38698[ADVISORY]
- https://github.com/hashicorp/consul/pull/10824[WEB]
- https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check-on-txn-apply-endpoint/29026[WEB]
- https://github.com/hashicorp/consul[PACKAGE]
- https://security.gentoo.org/glsa/202208-09[WEB]
- https://www.hashicorp.com/blog/category/consul[WEB]