CVE-2021-28156: High severity HashiCorp Consul vulnerability
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/consulto a version that resolves this vulnerability.Fixed in 1.9.5-r0 - Upgrade
Upgrade
HashiCorp Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.9.5 - Upgrade
Upgrade
HashiCorp Consul Enterpriseto a version that resolves this vulnerability.Fixed in 1.8.10
Event History
Frequently Asked Questions
What is CVE-2021-28156?
CVE-2021-28156 is a vulnerability in HashiCorp Consul Enterprise versions 1.8.0 up to 1.9.4 that allows the bypassing of the audit log through specially crafted HTTP events.
What is the severity of CVE-2021-28156?
The severity of CVE-2021-28156 is high, with a CVSS score of 7.5.
Which software versions are affected by CVE-2021-28156?
HashiCorp Consul Enterprise versions 1.8.0 up to 1.9.4 are affected by CVE-2021-28156.
How can I mitigate CVE-2021-28156?
To mitigate CVE-2021-28156, upgrade to HashiCorp Consul Enterprise version 1.8.10 or 1.9.5.
Where can I find more information about CVE-2021-28156?
You can find more information about CVE-2021-28156 on the HashiCorp discussion forum, Gentoo security advisories, and the HashiCorp blog.