CVE-2023-3518
Fixed in a distro release EPSS <1%CVSS 7.4
HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.
Products: HashiCorp Consul, HashiCorp Consul Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/consul | 1.16.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | consul-1.16 | 1.16.1-r0 |
| Chainguard | consul-1.16-oci-entrypoint | 1.16.1-r0 |
| Chainguard | consul-1.16-oci-entrypoint-compat | 1.16.1-r0 |
| Wolfi | consul-1.16 | 1.16.1-r0 |
| Wolfi | consul-1.16-oci-entrypoint | 1.16.1-r0 |
| Wolfi | consul-1.16-oci-entrypoint-compat | 1.16.1-r0 |