Skip to content
OpenAdvisories
High · 7.4 CVE-2023-3518 BIT-consul-2023-3518EUVD-2023-2260GHSA-9rhf-q362-77mxGO-2024-2704

JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access

Published Aug 9, 2023 · Updated Oct 8, 2024 · Assigned by HashiCorp

Vendor: HashiCorp Product: Consul Product: Consul Enterprise Package: github.com/hashicorp/consul Ecosystem: Go

Description

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.

Affected products

VendorProductAffectedFixed
HashiCorp Consul 1.16.0 —
HashiCorp Consul Enterprise 1.16.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/hashicorp/consul >= 1.16.0, < 1.16.1 1.16.1 GHSA-9rhf-q362-77mx

References