CVE-2020-28053: Medium severity hashicorp consul vulnerability
Published Nov 23, 2020
·Updated
HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.
Affected Software
9 affected componentsFixes available
go/github.com/hashicorp/consul>=1.8.0<1.8.6
1.8.6
go/github.com/hashicorp/consul>=1.7.0<1.7.10
1.7.10
go/github.com/hashicorp/consul>=1.2.0<1.6.10
1.6.10
Hashicorp Consul>=1.2.0<1.6.10
Hashicorp Consul>=1.2.0<1.6.10
Hashicorp Consul>=1.7.0<1.7.10
Hashicorp Consul>=1.7.0<1.7.10
Hashicorp Consul>=1.8.0<1.8.6
Hashicorp Consul>=1.8.0<1.8.6
Event History
Nov 23, 2020
CVE Published
via MITRE·01:11 PM
Data Sourced
via MITRE·01:11 PM
Description
Jan 31, 2024
Advisory Published
via GitHub·11:11 PM
Frequently Asked Questions
1
What is the severity of CVE-2020-28053?
CVE-2020-28053 is a medium severity vulnerability due to the improper access control allowing unauthorized users to read sensitive data.
2
How do I fix CVE-2020-28053?
To fix CVE-2020-28053, upgrade your HashiCorp Consul or Consul Enterprise instance to version 1.6.10, 1.7.10, or 1.8.6.
3
What versions are affected by CVE-2020-28053?
CVE-2020-28053 affects HashiCorp Consul and Consul Enterprise versions from 1.2.0 up to 1.8.5.
4
Who is affected by CVE-2020-28053?
Operators with operator:read ACL permissions in affected versions of HashiCorp Consul are vulnerable to CVE-2020-28053.
5
What kind of data is exposed in CVE-2020-28053?
CVE-2020-28053 allows unauthorized access to the Connect CA private key configuration.