HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions

高危 7.1CVE-2021-41803 · BIT-consul-2021-41803 · GHSA-hr3v-8cp3-68rf · Published 23/09/2022 · updated 17/06/2026

要点

CVE-2021-41803 是影响 github.com/hashicorp/consul, consul (hashicorp) 的高危 (CVSS 7.1)漏洞。
未来 30 天内被利用的概率（EPSS）：1.1%，高于 64.8% 的漏洞。
修复：升级到 1.12.5, 1.13.2, 1.11.9 或更高版本。

Package	Affected versions	Patched versions
github.com/hashicorp/consul Go	`≥ 1.12.0, < 1.12.5≥ 1.13.0, < 1.13.2≥ 1.8.1, < 1.11.9`	`1.12.51.13.21.11.9`
consul hashicorp	`= 1.12.4= 1.13.1≥ 1.8.1, < 1.11.9`	`1.11.9`

Description

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.

NVD description

HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2."