CVSS: 7.5EPSS: 86%CPEs: 7EXPL: 0CVE-2022-29153 – Gentoo Linux Security Advisory 202208-09
https://notcve.org/view.php?id=CVE-2022-29153
19 Apr 2022 — HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5. HashiCorp Consul y Consul Enterprise hasta 1.9.16, 1.10.9, y 1.11.4 pueden permitir la falsificación de peticiones del lado del servidor cuando el agente cliente de Consul sigue las redirecciones devueltas por los puntos finales de comprobación de salud HTTP. Corregido en 1.9... • https://discuss.hashicorp.com • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2022-24687 – Gentoo Linux Security Advisory 202208-09
https://notcve.org/view.php?id=CVE-2022-24687
24 Feb 2022 — HashiCorp Consul and Consul Enterprise 1.9.0 through 1.9.14, 1.10.7, and 1.11.2 clusters with at least one Ingress Gateway allow a user with service:write to register a specifically-defined service that can cause Consul servers to panic. Fixed in 1.9.15, 1.10.8, and 1.11.3. Los clusters de HashiCorp Consul y Consul Enterprise versiones 1.9.0 a 1.9.14, 1.10.7 y 1.11.2 con al menos un Ingress Gateway permiten que un usuario con service:write registre un servicio específicamente definido que puede hacer que lo... • https://discuss.hashicorp.com •
CVSS: 8.8EPSS: 3%CPEs: 3EXPL: 3CVE-2021-41805 – HashiCorp Consul Enterprise Privilege Escalation / Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-41805
12 Dec 2021 — HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace. HashiCorp Consul Enterprise versiones anteriores a 1.8.17, 1.9.x anteriores a 1.9.11 y 1.10.x anteriores a 1.10.4, presenta un Control de Acceso Incorrecto. Un token ACL (con el operador predeterminado: permisos de escritura) en un espacio de ... • https://packetstorm.news/files/id/183438 • CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-38698 – Gentoo Linux Security Advisory 202208-09
https://notcve.org/view.php?id=CVE-2021-38698
07 Sep 2021 — HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2. El endpoint Txn.Apply de HashiCorp Consul y Consul Enterprise versión 1.10.1, permitía que los servicios registraran proxies para otros servicios, permitiendo el acceso al tráfico de los mismos. Corregido en versiones 1.8.15, 1.9.9 y 1.10.2 Multiple vulnerabilities have been discovered in HashiCorp Consul, the worst o... • https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check-on-txn-apply-endpoint/29026 • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 2%CPEs: 6EXPL: 0CVE-2021-37219 – Gentoo Linux Security Advisory 202207-01
https://notcve.org/view.php?id=CVE-2021-37219
07 Sep 2021 — HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2. La capa RPC de HashiCorp Consul y Consul Enterprise Raft versión 1.10.1 , permite a agentes que no son servidores con un certificado válido firmado por la misma CA acceder a la funcionalidad server-only, permitiendo una escalada de privilegios. Corregido en 1.8.15, 1.9.9 y 1.... • https://discuss.hashicorp.com/t/hcsec-2021-22-consul-raft-rpc-privilege-escalation/29024 • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 0CVE-2021-36213 – Gentoo Linux Security Advisory 202208-09
https://notcve.org/view.php?id=CVE-2021-36213
17 Jul 2021 — HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1. La política de denegación por defecto de HashiCorp Consul y Consul Enterprise desde la versión 1.9.0 hasta la version 1.10.0 con una única acción de denegación de intención consciente de la aplicación L7 se anula, lo que provoca que la intención falle incorrectament... • https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-intentions-deny-action-fails-open-when-combined-with-default-deny-policy/26855 •
CVSS: 7.5EPSS: 1%CPEs: 6EXPL: 0CVE-2021-32574 – Gentoo Linux Security Advisory 202208-09
https://notcve.org/view.php?id=CVE-2021-32574
17 Jul 2021 — HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1. HashiCorp Consul y Consul Enterprise versión 1.3.0 hasta la versión 1.10.0 La configuración del proxy TLS de Envoy no valida la identidad del servicio de destino en el nombre alternativo del asunto codificado. Corregido en las versiones 1.8.14, 1.9.8 y 1.10.1 Multiple vulnerabilities have been dis... • https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856 • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-28156 – Gentoo Linux Security Advisory 202208-09
https://notcve.org/view.php?id=CVE-2021-28156
20 Apr 2021 — HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10. El registro de auditoría de HashiCorp Consul Enterprise versión 1.8.0 hasta 1.9.4 puede ser omitido por eventos HTTP específicamente diseñados. Corregido en versiones 1.9.5 y 1.8.10 Multiple vulnerabilities have been discovered in HashiCorp Consul, the worst of which could result in denial of service. Versions less than 1.9.17 are affected. • https://discuss.hashicorp.com/t/hcsec-2021-08-consul-enterprise-audit-log-bypass-for-http-events/23369 •
CVSS: 6.1EPSS: 84%CPEs: 6EXPL: 0CVE-2020-25864 – Gentoo Linux Security Advisory 202208-09
https://notcve.org/view.php?id=CVE-2020-25864
20 Apr 2021 — HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14. El modo sin procesar de HashiCorp Consul y Consul Enterprise hasta versión 1.9.4, key-value (KV) era vulnerable a un ataque de tipo cross-site scripting. Corregido en versiones 1.9.5, 1.8.10 y 1.7.14 Multiple vulnerabilities have been discovered in HashiCorp Consul, the worst of which could result in denial of service. Versions less than 1.9.17 ar... • https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.6EPSS: 0%CPEs: 7EXPL: 0CVE-2021-3121 – gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation
https://notcve.org/view.php?id=CVE-2021-3121
11 Jan 2021 — An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue. Se detectó un problema en GoGo Protobuf versiones anteriores a 1.3.2. El archivo plugin/unmarshal/unmarshal.go carece de determinada comprobación de índice, también se conoce como el problema "skippy peanut butter" A flaw was found in github.com/gogo/protobuf before 1.3.2 that allows an out-of-bounds access when unmarshalling certain protobuf objects... • https://discuss.hashicorp.com/t/hcsec-2021-23-consul-exposed-to-denial-of-service-in-gogo-protobuf-dependency/29025 • CWE-129: Improper Validation of Array Index •