Improper authorization control for web services In github.com/hashicorp/consul
Description
HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 1.11.9, 1.12.5, 1.13.2 | ||
 debian 11 | - | ||
go | 1.11.9 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4. 5. 6.