high7.5
CVE-2019-12291
HashiCorp Consul Incorrect Access Control vulnerability
Impact
HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured. ### Specific Go Packages Affected github.com/hashicorp/consul/acl
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/hashicorp/consul | >= 1.4.0, < 1.5.1 | 1.5.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Consul | from 1.4.0 through 1.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/hashicorp/consul/issues/5888
- https://github.com/advisories/GHSA-h65h-v7fw-4p38
- https://nvd.nist.gov/vuln/detail/CVE-2019-12291
- https://github.com/hashicorp/consul/commit/36ebca1fd0129278487c6570449bc8cc03987890
- https://www.hashicorp.com/blog/category/consul