CVE-2020-13170: Improper Input Validation

May 18, 2021 (updated October 2, 2023)

HashiCorp Consul and Consul Enterprise does not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.

References

github.com/advisories/GHSA-p2j5-3f4c-224r
github.com/hashicorp/consul/blob/v1.6.6/CHANGELOG.md
github.com/hashicorp/consul/blob/v1.7.4/CHANGELOG.md
github.com/hashicorp/consul/commit/242994a016a181d6c62a5bb83189716ad13d4216
github.com/hashicorp/consul/pull/8068
nvd.nist.gov/vuln/detail/CVE-2020-13170

Code Behaviors & Features

Detect and mitigate CVE-2020-13170 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →