Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
32 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.
Recommended action: Upgrade to 1.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In HashiCorp Consul before 1.10.1 (and Consul Enterprise), xds can generate a situation where a single L7 deny intention (with a default deny policy) results in an allow action.
Recommended action: Upgrade to 1.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Consul before 1.10.1 (and Consul Enterprise) has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated.
Recommended action: Upgrade to 1.10.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/consul >= 1.6.0, < 1.6.6; >= 1.7.0, < 1.7.4
Fixed in
1.6.61.7.4· Vendor fix available
Issue
HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. Specific Go Packages Affected github.com/hashicorp/consul/agent/structs
Recommended action: Upgrade to 1.7.4 or 1.6.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/consul >= 1.2.0, < 1.6.6; >= 1.7.0, < 1.7.4
Fixed in
1.6.61.7.4· Vendor fix available
Issue
HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Specific Go Packages Affected github.com/hashicorp/consul/agent/config Fix The vulnerability is fixed in versions 1.6.6 and 1.7.4.
Recommended action: Upgrade to 1.7.4 or 1.6.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/consul >= 1.6.0-beta1, < 1.6.6; >= 1.7.0, < 1.7.4
Fixed in
1.6.61.7.4· Vendor fix available
Issue
HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. Specific Go Packages Affected github.com/hashicorp/consul/agent
Recommended action: Upgrade to 1.7.4 or 1.6.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3. Specific Go Packages Affected github.com/hashicorp/consul/agent/consul
Recommended action: Upgrade to 1.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.