From 85595ab3ea383ee742638827ccb3b3845f81d29a Mon Sep 17 00:00:00 2001 From: Joel Watson Date: Tue, 10 Nov 2020 16:01:34 -0600 Subject: [PATCH] docs: add warning in 0.9.0 upgrade notes --- website/pages/docs/upgrading/upgrade-specific.mdx | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/website/pages/docs/upgrading/upgrade-specific.mdx b/website/pages/docs/upgrading/upgrade-specific.mdx index ab16142927..8db12f9df1 100644 --- a/website/pages/docs/upgrading/upgrade-specific.mdx +++ b/website/pages/docs/upgrading/upgrade-specific.mdx @@ -593,6 +593,11 @@ as part of upgrading agents. If this is set to `true`, you should also enable to provide control over which users are allowed to register health checks that could potentially execute scripts on the agent machines. +!> **Security Warning:** Using `enable_script_checks` without ACLs and without +`allow_write_http_from` is _DANGEROUS_. Use the `enable_local_script_checks` setting +introduced in v0.9.4 instead. See [this article](https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurations/) +for more information. + #### Web UI Is No Longer Released Separately Consul releases will no longer include a `web_ui.zip` file with the compiled