HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted     HTTP events. Fixed in 1.9.5, and 1.8.10. (CVE-2021-28156)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the consul package has been released.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to
    cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14. (CVE-2020-25864)

  - HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted
    HTTP events. Fixed in 1.9.5, and 1.8.10. (CVE-2021-28156)

The remote host is affected by the vulnerability described in GLSA-202208-09 (HashiCorp Consul: Multiple Vulnerabilities)

  - HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be     triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5. (CVE-2020-25201)

  - HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to     cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14. (CVE-2020-25864)

  - HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL     permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.
    (CVE-2020-28053)

  - HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted     HTTP events. Fixed in 1.9.5, and 1.8.10. (CVE-2021-28156)

  - HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not     validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and     1.10.1. (CVE-2021-32574)

  - HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7     application-aware intention deny action cancels out, causing the intention to incorrectly fail open,     allowing L4 traffic. Fixed in 1.9.8 and 1.10.1. (CVE-2021-36213)

  - HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for     other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2. (CVE-2021-38698)

  - HashiCorp Consul and Consul Enterprise 1.8.0 through 1.9.14, 1.10.7, and 1.11.2 has Uncontrolled Resource     Consumption. (CVE-2022-24687)

  - HashiCorp Consul and Consul Enterprise through 2022-04-12 allow SSRF. (CVE-2022-29153)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Hashicorp reports :

Add content-type headers to raw KV responses to prevent XSS attacks (CVE-2020-25864). audit-logging: Parse endpoint URL to prevent requests from bypassing the audit log (CVE-2021-28156).

ID	Name	Product	Family	Severity
258544	Linux Distros Unpatched Vulnerability : CVE-2021-28156	Nessus	Misc.	high
203348	Photon OS 4.0: Consul PHSA-2021-4.0-0016	Nessus	PhotonOS Local Security Checks	high
403881	Alpine: consul: security update to 1.9.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
403881	Alpine: consul: security update to 1.9.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
163985	GLSA-202208-09 : HashiCorp Consul: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
148750	FreeBSD : Consul -- Multiple vulnerabilities (093a6baf-9f99-11eb-b150-000c292ee6b8)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2021-28156

high

Tenable Plugins

high

high

high

high

high

high