CVE-2019-16377: Critical severity hashicorp consul vulnerability
The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.
Other sources
With the consul ruby gem before 1.0.3, if a controller checks multiple powers using :if or :except conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-16377?
CVE-2019-16377 has been categorized as a high severity vulnerability due to incorrect access control leading to potential unauthorized actions.
How do I fix CVE-2019-16377?
To resolve CVE-2019-16377, update the makandra consul gem to version 1.0.3 or later.
What impact does CVE-2019-16377 have on my application?
CVE-2019-16377 can lead to unauthorized access by bypassing access checks in your application when using the consul gem.
What versions are affected by CVE-2019-16377?
CVE-2019-16377 affects versions of the makandra consul gem prior to 1.0.3.
Is my application safe if I am using version 1.0.3 of the consul gem?
Yes, if you are using version 1.0.3 or later, your application is not affected by CVE-2019-16377.