CVE-2023-2816
Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
Summary
Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
Original description
The description as published by the source.
Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
consul
[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.15.3"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.hashicorp.com