CVE-2023-2816
Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
概要
Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
consul
[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.15.3"}]}]
参照URL
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.hashicorp.com