x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-hr3v-8cp3-68rf

[GoVulnBot]

In GitHub Security Advisory GHSA-hr3v-8cp3-68rf, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/hashicorp/consul	1.13.2	>= 1.13.0, < 1.13.2

Cross references:

• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-6hw5-6gcx-phmw #559 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-ccw8-7688-vqx4 #593 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-q6h7-4qgw-2j9p #615 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul/agent/structs: GHSA-hwqm-x785-qh8p #847 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul/agent: GHSA-p2j5-3f4c-224r #859 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul/agent/consul/discoverychain: GHSA-q2qr-3c2p-9235 #861 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-r9w6-rhh9-7v53 #874 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul/agent/config: GHSA-rqjq-mrgx-85hp #879 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-25gf-8qrr-g78r, CVE-2021-32574 #894 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: CVE-2021-36213, GHSA-8h2g-r292-j8xh #895 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: CVE-2022-24687, GHSA-hj93-5fg3-3chr #953 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-m69r-9g56-7mv8 #1029 EFFECTIVELY_PRIVATE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-gw2g-hhc9-wgjh #1121 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-wj6x-hcc2-f32j #1639 NOT_IMPORTABLE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-c57c-7hrj-6q6v #1827 EFFECTIVELY_PRIVATE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-rqjq-ww83-wv5c #1828 EFFECTIVELY_PRIVATE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-4qvx-qq5w-695p #1850 EFFECTIVELY_PRIVATE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-8xmx-h8rq-h94j #1851 EFFECTIVELY_PRIVATE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-q7fx-wm2p-qfj8 #1853 EFFECTIVELY_PRIVATE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-fhm8-cxcv-pwvc #1945 EFFECTIVELY_PRIVATE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-496g-fr33-whrf #2501 EFFECTIVELY_PRIVATE
• Module github.com/hashicorp/consul appears in issue x/vulndb: potential Go vuln in github.com/hashicorp/consul: GHSA-6m72-467w-94rh #2505 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/hashicorp/consul
      versions:
        - introduced: 1.13.0
          fixed: 1.13.2
      vulnerable_at: 1.13.1
      packages:
        - package: github.com/hashicorp/consul
    - module: github.com/hashicorp/consul
      versions:
        - introduced: 1.12.0
          fixed: 1.12.5
      vulnerable_at: 1.12.4
      packages:
        - package: github.com/hashicorp/consul
    - module: github.com/hashicorp/consul
      versions:
        - introduced: 1.8.1
          fixed: 1.11.9
      vulnerable_at: 1.11.8
      packages:
        - package: github.com/hashicorp/consul
summary: |-
    HashiCorp Consul does not properly validate node or segment names prior to usage
    in JWT claim assertions
cves:
    - CVE-2021-41803
ghsas:
    - GHSA-hr3v-8cp3-68rf
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2021-41803
    - web: https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627
    - web: https://lists.fedoraproject.org/archives/list/[email protected]/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC
    - web: https://lists.fedoraproject.org/archives/list/[email protected]/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE
    - web: https://lists.fedoraproject.org/archives/list/[email protected]/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI
    - advisory: https://github.com/advisories/GHSA-hr3v-8cp3-68rf

[gopherbot]

Change https://go.dev/cl/576875 mentions this issue: data/reports: add GO-2024-2683.yaml