Skip to content

x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-fhm8-cxcv-pwvc #1945

New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom
Closed
GoVulnBot opened this issue Jul 19, 2023 · 3 comments
Closed

x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-fhm8-cxcv-pwvc #1945

GoVulnBot opened this issue Jul 19, 2023 · 3 comments
Assignees
@neild
Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.

Comments

@GoVulnBot
Copy link

In GitHub Security Advisory GHSA-fhm8-cxcv-pwvc, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/hashicorp/consul 1.4.3 >= 1.4, < 1.4.3

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/hashicorp/consul
      versions:
        - introduced: 1.4.0
          fixed: 1.4.3
      vulnerable_at: 1.4.2
      packages:
        - package: github.com/hashicorp/consul
summary: HashiCorp Consul Access Restriction Bypass
description: |-
    HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to
    bypass intended access restrictions and obtain the privileges of one other
    arbitrary token within secondary datacenters, because a token with literally
    "<hidden>" as its secret is used in unusual circumstances.
cves:
    - CVE-2019-8336
ghsas:
    - GHSA-fhm8-cxcv-pwvc
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2019-8336
    - report: https://github.com/hashicorp/consul/issues/5423
    - fix: https://github.com/hashicorp/consul/commit/90040f8bffb311e6cd8599273e95b607175e311f
    - web: https://github.com/hashicorp/consul/blob/003370ded024096cd89fb2aa2bc15293c23b9707/agent/consul/leader.go#L405
    - advisory: https://github.com/advisories/GHSA-fhm8-cxcv-pwvc
@neild neild self-assigned this Jul 25, 2023
@neild neild added the excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module. label Jul 25, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/513195 mentions this issue: data/excluded: batch add 26 excluded reports

This was referenced Feb 1, 2024
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Apr 3, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Apr 10, 2024
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/606788 mentions this issue: data/reports: unexclude 20 reports (8)

gopherbot pushed a commit that referenced this issue Aug 20, 2024
@tatianab @gopherbot
data/reports: unexclude 20 reports (8)
adfc865 
  - data/reports/GO-2023-1912.yaml
  - data/reports/GO-2023-1915.yaml
  - data/reports/GO-2023-1919.yaml
  - data/reports/GO-2023-1922.yaml
  - data/reports/GO-2023-1924.yaml
  - data/reports/GO-2023-1925.yaml
  - data/reports/GO-2023-1927.yaml
  - data/reports/GO-2023-1928.yaml
  - data/reports/GO-2023-1931.yaml
  - data/reports/GO-2023-1932.yaml
  - data/reports/GO-2023-1936.yaml
  - data/reports/GO-2023-1938.yaml
  - data/reports/GO-2023-1939.yaml
  - data/reports/GO-2023-1940.yaml
  - data/reports/GO-2023-1942.yaml
  - data/reports/GO-2023-1945.yaml
  - data/reports/GO-2023-1946.yaml
  - data/reports/GO-2023-1948.yaml
  - data/reports/GO-2023-1950.yaml
  - data/reports/GO-2023-1952.yaml

Updates #1912
Updates #1915
Updates #1919
Updates #1922
Updates #1924
Updates #1925
Updates #1927
Updates #1928
Updates #1931
Updates #1932
Updates #1936
Updates #1938
Updates #1939
Updates #1940
Updates #1942
Updates #1945
Updates #1946
Updates #1948
Updates #1950
Updates #1952

Change-Id: Id25f09c8f7270af68238752db96d6a399b91ef36
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/606788
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
This was referenced Oct 31, 2024
Closed
Closed
Closed
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@neild neild

Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@neild @gopherbot @GoVulnBot