HIGH 7.1
GHSA-hr3v-8cp3-68rf
HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions
빠른 조치
GHSA-hr3v-8cp3-68rf — github.com/hashicorp/consul: 아래 명령으로 수정 버전으로 올리세요.
go get github.com/hashicorp/consul@v1.11.9상세
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
Go / github.com/hashicorp/consul
최초 영향 버전:
1.8.1 수정 버전: 1.11.9 수정
go get github.com/hashicorp/consul@v1.11.9 Go / github.com/hashicorp/consul
최초 영향 버전:
1.12.0 수정 버전: 1.12.5 수정
go get github.com/hashicorp/consul@v1.12.5 Go / github.com/hashicorp/consul
최초 영향 버전:
1.13.0 수정 버전: 1.13.2 수정
go get github.com/hashicorp/consul@v1.13.2 참고
- https://nvd.nist.gov/vuln/detail/CVE-2021-41803 [ADVISORY]
- https://github.com/hashicorp/consul/pull/14577/commits/2c881259ce10e308ff03afc968c4165998fd7fee [WEB]
- https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627 [WEB]
- https://github.com/hashicorp/consul [PACKAGE]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC [WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE [WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI [WEB]