VDB
CVE-2021-41803
CVE-2021-41803
PUBLISHED
CVSS 7.099999904632568 HIGH
HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."
EPSS 1.07% · 64.5th percentile
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
EPSS Score
1.07%
64.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | consul | 1.13.1, 1.12.4, 1.8.1 |
| Bitnami | consul | 1.8.1, 1.12.4, 1.13.1 |
Timeline
- Sep 23, 2022 CVE Published
- Sep 23, 2022 EPSS Score
- Nov 7, 2022 EPSS Score
- Dec 23, 2022 EPSS Score
- Feb 6, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 24, 2023 EPSS Score
- May 8, 2023 EPSS Score
- Jun 23, 2023 EPSS Score
- Sep 22, 2023 EPSS Score
- Nov 6, 2023 EPSS Score
- Dec 22, 2023 EPSS Score
References
- https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627 advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/ url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/ url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/ url
- https://www.hashicorp.com/blog/category/consul advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-41803 url