Affected: Bitnami: consul

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.

Withdrawn by the publisher.

Affected: CleanStart: opentofu-fips

Multiple security vulnerabilities affect the opentofu-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.

Affected: Go: github.com/hashicorp/consul

A vulnerability was identified in Consul and Consul Enterprise ("Consul") such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.

Security update for govulncheck-vulndb

hashicorp/consul: consul: Consul L7 Intentions Vulnerable To URL Path Bypass hashicorp/consul: consul: Consul L7 Intentions Vulnerable To Headers Bypass quic-go: memory exhaustion attack against QUIC's connection ID mechanism golang: archive/zip: Incorrect handling of certain ZIP files traefik: denial of service traefik: Bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html cipher-base: Cipher-base hash manipulation sha.js: Missing type checks leading to hash rewind and passing on crafted data git: Git arbitrary file writes tar-fs: tar-fs has issue where extract can write outside the specified dir with a specific tarball com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError

Security update for govulncheck-vulndb

Affected: Ubuntu:18.04:LTS: consul, Ubuntu:20.04:LTS: consul, Ubuntu:22.04:LTS: consul

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.