CVE-2019-8336: High severity hashicorp consul vulnerability
HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "<hidden>" as its secret is used in unusual circumstances.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-8336?
CVE-2019-8336 is a vulnerability in HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 that allows a client to bypass intended access restrictions and obtain the privileges of another arbitrary token within secondary datacenters.
How severe is CVE-2019-8336?
CVE-2019-8336 has a severity score of 8.1 (high).
Which software versions are affected by CVE-2019-8336?
HashiCorp Consul (and Consul Enterprise) versions 1.4.0 to 1.4.3 are affected by CVE-2019-8336.
How can I fix CVE-2019-8336?
To fix CVE-2019-8336, you should update HashiCorp Consul (and Consul Enterprise) to version 1.4.3.
Where can I find more information about CVE-2019-8336?
You can find more information about CVE-2019-8336 on the National Vulnerability Database (NVD) [link](https://nvd.nist.gov/vuln/detail/CVE-2019-8336) and the HashiCorp Consul GitHub repository [link](https://github.com/hashicorp/consul/issues/5423).