CVE-2019-8336
First published: Tue Mar 05 2019(Updated: )
HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "<hidden>" as its secret is used in unusual circumstances.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/hashicorp/consul | >=1.4.0<1.4.3 | 1.4.3 |
| HashiCorp Consul | >=1.4.0<1.4.3 | |
| HashiCorp Consul | >=1.4.0<1.4.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2019-8336
- https://github.com/hashicorp/consul/issues/5423
- https://github.com/hashicorp/consul/commit/90040f8bffb311e6cd8599273e95b607175e311f
- https://github.com/hashicorp/consul/blob/003370ded024096cd89fb2aa2bc15293c23b9707/agent/consul/leader.go#L405
- https://github.com/advisories/GHSA-fhm8-cxcv-pwvc (Advisory)
Frequently Asked Questions
What is CVE-2019-8336?
CVE-2019-8336 is a vulnerability in HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 that allows a client to bypass intended access restrictions and obtain the privileges of another arbitrary token within secondary datacenters.
How severe is CVE-2019-8336?
CVE-2019-8336 has a severity score of 8.1 (high).
Which software versions are affected by CVE-2019-8336?
HashiCorp Consul (and Consul Enterprise) versions 1.4.0 to 1.4.3 are affected by CVE-2019-8336.
How can I fix CVE-2019-8336?
To fix CVE-2019-8336, you should update HashiCorp Consul (and Consul Enterprise) to version 1.4.3.
Where can I find more information about CVE-2019-8336?
You can find more information about CVE-2019-8336 on the National Vulnerability Database (NVD) [link](https://nvd.nist.gov/vuln/detail/CVE-2019-8336) and the HashiCorp Consul GitHub repository [link](https://github.com/hashicorp/consul/issues/5423).
- collector/github-advisory-latest
- alias/GHSA-fhm8-cxcv-pwvc
- alias/CVE-2019-8336
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/references
- agent/weakness
- agent/event
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- package-manager/go
- vendor/hashicorp
- canonical/hashicorp consul
- version/hashicorp consul/1.4.0