Affected by GO-2022-0615 and 11 other vulnerabilities

GO-2022-0615: Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector in github.com/hashicorp/consul

GO-2022-0894: Hashicorp Consul Missing SSL Certificate Validation in github.com/hashicorp/consul

GO-2022-0895: HashiCorp Consul L7 deny intention results in an allow action in github.com/hashicorp/consul

GO-2022-0953: HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers in github.com/hashicorp/consul

GO-2022-1029: HashiCorp Consul vulnerable to authorization bypass in github.com/hashicorp/consul

GO-2023-1827: Hashicorp Consul vulnerable to denial of service in github.com/hashicorp/consul

GO-2024-3241: Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability in github.com/hashicorp/consul

GO-2024-3242: Hashicorp Consul Cross-site Scripting vulnerability in github.com/hashicorp/consul

GO-2024-3243: Hashicorp Consul Path Traversal vulnerability in github.com/hashicorp/consul

GO-2025-4081: Consul key/value endpoint is vulnerable to denial of service in github.com/hashicorp/consul

GO-2025-4082: Consul event endpoint is vulnerable to denial of service in github.com/hashicorp/consul

GO-2026-4690: Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication in github.com/hashicorp/consul

testauth

package

v1.10.1-beta1 Latest Latest Go to latest Published: Jul 1, 2021 License: MPL-2.0 Imports: 8 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/hashicorp/consul

Links

Open Source Insights

Documentation ¶

Index ¶

func GetSessionToken(sessionID string, token string) (map[string]string, bool)
func InstallSessionToken(sessionID string, token string, namespace, name, uid string)
func ResetSession(sessionID string)
func StartSession() string
type Config
type Validator

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func GetSessionToken ¶

func GetSessionToken(sessionID string, token string) (map[string]string, bool)

func InstallSessionToken ¶

func InstallSessionToken(sessionID string, token string, namespace, name, uid string)

func ResetSession ¶

func ResetSession(sessionID string)

func StartSession ¶

func StartSession() string

Types ¶

type Config ¶

type Config struct {
	SessionID string            // unique identifier for this set of tokens in the database
	Data      map[string]string `json:",omitempty"` // random data for testing
	// contains filtered or unexported fields
}

type Validator ¶

type Validator struct {
	// contains filtered or unexported fields
}

func (*Validator) Name ¶

func (v *Validator) Name() string

func (*Validator) NewIdentity ¶ added in v1.8.0

func (v *Validator) NewIdentity() *authmethod.Identity

func (*Validator) Stop ¶ added in v1.8.0

func (v *Validator) Stop()

func (*Validator) ValidateLogin ¶

func (v *Validator) ValidateLogin(ctx context.Context, loginToken string) (*authmethod.Identity, error)

ValidateLogin takes raw user-provided auth method metadata and ensures it is sane, provably correct, and currently valid. Relevant identifying data is extracted and returned for immediate use by the role binding process.

Depending upon the method, it may make sense to use these calls to continue to extend the life of the underlying token.

Returns auth method specific metadata suitable for the Role Binding process.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL