CVE-2022-40716
HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint...
概要
HashiCorp Consul vulnerable to authorization bypass
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
consul
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.9"},{"introduced":"1.12.0"},{"fixed":"1.12.5"},{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]
Go
github.com/hashicorp/consul
[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-40716 consul
参照URL
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.hashicorp.com
- web discuss.hashicorp.com
- web github.com
- web github.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org