CVE-2023-2816
Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
Résumé
Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
consul
[{"type":"SEMVER","events":[{"introduced":"1.15.0"},{"fixed":"1.15.3"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.hashicorp.com