| Name | CVE-2021-41803 |
| Description | HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2." |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1034841 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| consul (PTS) | buster | 1.0.7~dfsg1-5 | fixed |
| bullseye | 1.8.7+dfsg1-2 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| consul | source | buster | (not affected) | |||
| consul | source | (unstable) | (unfixed) | 1034841 |
[bullseye] - consul <no-dsa> (Minor issue)
[buster] - consul <not-affected> (Vulnerable Code not present)
https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627
https://github.com/hashicorp/consul/commit/34872682e44f6e7e6359c88bf9e333fa1002a99b (v1.11.9)