ALT-PU-2020-3391: package consul update to version 1.8.6-alt1
Описание
This update upgrades consul to version 1.8.6-alt1.
Устраненные уязвимости8
Ссылки9
GHSA-23jv-v6qj-3fhh
https://github.com/advisories/GHSA-23jv-v6qj-3fhhGHSA-6m72-467w-94rh
https://github.com/advisories/GHSA-6m72-467w-94rhGHSA-h65h-v7fw-4p38
https://github.com/advisories/GHSA-h65h-v7fw-4p38GHSA-hwqm-x785-qh8p
https://github.com/advisories/GHSA-hwqm-x785-qh8pGHSA-p2j5-3f4c-224r
https://github.com/advisories/GHSA-p2j5-3f4c-224rGHSA-q7fx-wm2p-qfj8
https://github.com/advisories/GHSA-q7fx-wm2p-qfj8GHSA-r9w6-rhh9-7v53
https://github.com/advisories/GHSA-r9w6-rhh9-7v53GHSA-rqjq-mrgx-85hp
https://github.com/advisories/GHSA-rqjq-mrgx-85hpСвязанные уязвимости
HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.
HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.
HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Key ...
HashiCorp Consul Incorrect Access Control vulnerability
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.