Affected by GO-2022-0559
and 10 other vulnerabilities
GO-2022-0559: HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. in github.com/hashicorp/consul
GO-2022-0593: HashiCorp Consul Privilege Escalation Vulnerability in github.com/hashicorp/consul
GO-2022-0615: Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector in github.com/hashicorp/consul
GO-2022-0894: Hashicorp Consul Missing SSL Certificate Validation in github.com/hashicorp/consul
GO-2022-0895: HashiCorp Consul L7 deny intention results in an allow action in github.com/hashicorp/consul
GO-2022-0953: HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers in github.com/hashicorp/consul
GO-2022-1029: HashiCorp Consul vulnerable to authorization bypass in github.com/hashicorp/consul
GO-2023-1827: Hashicorp Consul vulnerable to denial of service in github.com/hashicorp/consul
GO-2024-3241: Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability in github.com/hashicorp/consul
GO-2024-3242: Hashicorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul
GO-2024-3243: Hashicorp Consul Path Traversal vulnerability in github.com/hashicorp/consul
type Config struct {
SessionID string// unique identifier for this set of tokens in the database Data map[string]string `json:",omitempty"` // random data for testing// contains filtered or unexported fields
}
ValidateLogin takes raw user-provided auth method metadata and ensures it is
sane, provably correct, and currently valid. Relevant identifying data is
extracted and returned for immediate use by the role binding process.
Depending upon the method, it may make sense to use these calls to continue
to extend the life of the underlying token.
Returns auth method specific metadata suitable for the Role Binding process.