Skip to content
OpenAdvisories
Medium · 5.3 CVE-2020-7955 BIT-consul-2020-7955EUVD-2021-1487GHSA-r9w6-rhh9-7v53GO-2022-0874

Incorrect Authorization in HashiCorp Consul

Published Jan 31, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Package: consul Package: consul Package: github.com/hashicorp/consul Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu

Description

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 11 consul 1.7.0+dfsg1-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS consul No fix yet —
Ubuntu 20.04 LTS consul No fix yet —
Ubuntu 18.04 LTS consul No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/hashicorp/consul >= 1.4.1, < 1.6.3 1.6.3 GHSA-r9w6-rhh9-7v53

References