CVE PROGRAM SOURCE RECORD7.4 High

CVE-2023-3518

JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access

Status: Published
Published: 2023-08-09
Updated: 2024-10-08
Assigning organization: HashiCorp

Description

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Consul

Default version status: unaffected

1.16.0affected

HashiCorp Consul Enterprise

Default version status: unaffected

1.16.0affected

References

https://discuss.hashicorp.com/t/hcsec-2023-25-consul-jwt-auth-in-l7-intentions-allow-for-mismatched-service-identity-and-jwt-providers/57004 ↗