GO-2024-2683

vendorUSosv

Improper handling of node names in JWT claims assertions in github.com/hashicorp/consul

view advisory published 2024-04-05Licence: per source

HashiCorp Consul does not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-41803US	high7.1OT elevated	1.07% (65th)	—	2022-09-23
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto co…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627WEB
https://github.com/hashicorp/consul/pull/14577/commits/2c881259ce10e308ff03afc968c4165998fd7feeFIX

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan