CVE-2020-28053

HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key confi...

Original description

The description as published by the source.

HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami consul

[{"type":"SEMVER","events":[{"introduced":"1.2.0"},{"fixed":"1.6.10"},{"introduced":"1.7.0"},{"fixed":"1.7.10"},{"introduced":"1.8.0"},{"fixed":"1.8.6"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2020-28053 consul Fixed in: 1.8.6+dfsg1-1

References

advisory github.com
advisory security.gentoo.org
advisory hashicorp.com
web nvd.nist.gov