CVE-2022-40716
HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint...
Résumé
HashiCorp Consul vulnerable to authorization bypass
Description d'origine
La description telle que publiée par la source (souvent en anglais).
HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2."
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
consul
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.9"},{"introduced":"1.12.0"},{"fixed":"1.12.5"},{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]
Go
github.com/hashicorp/consul
[{"type":"SEMVER","events":[{"introduced":"1.13.0"},{"fixed":"1.13.2"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-40716 consul
Références
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.hashicorp.com
- web discuss.hashicorp.com
- web github.com
- web github.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org