HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a     primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0,     fixed in 1.6.6 and 1.7.4. (CVE-2020-13170)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a
    primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0,
    fixed in 1.6.6 and 1.7.4. (CVE-2020-13170)

An update of the consul package has been released.

ID	Name	Product	Family	Type	Severity
257630	Linux Distros Unpatched Vulnerability : CVE-2020-13170	Nessus	Misc.	Local	high
417224	SCA: security update for github.com/hashicorp/consul (GHSA-p2j5-3f4c-224r)	Tenable Cloud Security	SCA Checks	Local	high
417224	SCA: security update for github.com/hashicorp/consul (GHSA-p2j5-3f4c-224r)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
203044	Photon OS 3.0: Consul PHSA-2020-3.0-0151	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2020-13170

high

Tenable Plugins

high

high

high

high