| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/hashicorp/consul | ≥ 1.10.1, < 1.10.2≥ 1.9.0, < 1.9.9< 1.8.15 | 1.10.21.9.91.8.15 |
| consul | ≥ 1.10.0, < 1.10.2≥ 1.9.0, < 1.9.9< 1.8.15 | 1.10.21.9.91.8.15 |
HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free