Bug 907925 (CVE-2023-1297, CVE-2023-2816) – <app-admin/consul-1.15.3: multiple vulnerabilities

• Product: Gentoo Security
• Status: IN_PROGRESS ---

[Description John Helmert III 2023-06-06 03:49:21 UTC]

CVE-2023-1297 (https://discuss.hashicorp.com/t/hcsec-2023-15-consul-cluster-peering-can-result-in-denial-of-service/54515):

Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3

CVE-2023-2816 (https://discuss.hashicorp.com/t/hcsec-2023-16-consul-envoy-extension-downstream-proxy-configuration-by-upstream-service-owner/54525):

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.

Please bump to 1.15.3.

[Comment 1 Larry the Git Cow 2023-06-06 04:48:13 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=dd43565bacbde04cd2d5c24cf7ecdbc3451f4c28

commit dd43565bacbde04cd2d5c24cf7ecdbc3451f4c28
Author:     Zac Medico <[e-mail]>
AuthorDate: 2023-06-06 04:47:22 +0000
Commit:     Zac Medico <[e-mail]>
CommitDate: 2023-06-06 04:48:09 +0000

    app-admin/consul: add 1.15.3
    
    Bug: https://bugs.gentoo.org/907925
    Signed-off-by: Zac Medico <[e-mail]>

 app-admin/consul/Manifest             |  1 +
 app-admin/consul/consul-1.15.3.ebuild | 57 +++++++++++++++++++++++++++++++++++
 2 files changed, 58 insertions(+)

[Comment 2 John Helmert III 2023-06-12 04:26:20 UTC]

Please stabilize when ready, thanks!

[Comment 3 Larry the Git Cow 2023-10-21 00:53:15 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=39881bb9bcaa4019ff5c02314eaa465bcce39084

commit 39881bb9bcaa4019ff5c02314eaa465bcce39084
Author:     Zac Medico <[e-mail]>
AuthorDate: 2023-10-21 00:52:24 +0000
Commit:     Zac Medico <[e-mail]>
CommitDate: 2023-10-21 00:52:30 +0000

    app-admin/consul: drop vulnerable 1.15.2
    
    Bug: https://bugs.gentoo.org/907925
    Signed-off-by: Zac Medico <[e-mail]>

 app-admin/consul/Manifest             |  1 -
 app-admin/consul/consul-1.15.2.ebuild | 57 -----------------------------------
 2 files changed, 58 deletions(-)

[Comment 4 Larry the Git Cow 2024-12-08 08:39:00 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=8e9782e9da489c617d2f765d94af1f83cb851840

commit 8e9782e9da489c617d2f765d94af1f83cb851840
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-12-08 08:38:34 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-12-08 08:38:57 +0000

    [ GLSA 202412-14 ] HashiCorp Consul: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/907925
    Bug: https://bugs.gentoo.org/917614
    Bug: https://bugs.gentoo.org/925030
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202412-14.xml | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)