consul/.changelog
Freddy 8ed789766b Require operator:write to get Connect CA config (#9240)
A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that operators with `operator:read` ACL permissions are able to read the Consul Connect CA configuration when explicitly configured with the `/v1/connect/ca/configuration` endpoint, including the private key. This allows the user to effectively privilege escalate by enabling the ability to mint certificates for any Consul Connect services. This would potentially allow them to masquerade (receive/send traffic) as any service in the mesh.

--

This PR increases the permissions required to read the Connect CA's private key when it was configured via the `/connect/ca/configuration` endpoint. They are now `operator:write`.
2020-11-19 13:21:51 -07:00
..
7628.txt Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
7899.txt Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
7970.txt Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
8158.txt Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
8190.txt Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
8194.txt Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
8211.txt Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
8216.txt Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
8218.txt Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
8222.txt Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
8268.txt Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
8311.txt Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
8343.txt Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
8371.txt Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
8458.txt Add http2 and grpc support to ingress gateways (#8458) 2020-08-27 15:41:39 -06:00
8494.txt [backport/1.8.x] connect: use stronger validation that ingress gateways have compatible protocols defined for their upstreams (#8494) 2020-08-13 15:26:23 -05:00
8522.txt add primary keys to list keyring (#8522) 2020-08-18 07:51:22 +00:00
8537.txt Merge pull request #8577 from hashicorp/dnephin/changelog-for-8537 2020-08-31 15:57:37 +00:00
8545.txt agent: expose the list of supported envoy versions on /v1/agent/self (#8566) 2020-08-27 11:33:33 -05:00
8547.txt agent: ensure that we normalize bootstrapped config entries (#8547) 2020-09-02 19:21:58 +00:00
8552.txt Merge pull request #8586 from pierresouchay/changelog_for_8552 2020-08-28 21:36:19 +00:00
8560.txt Update vault CA for latest api client 2020-10-07 16:40:27 -04:00
8575.txt Add helpers to the API client to help with getting information from `AgentMember` tags (#8575) 2020-08-27 15:01:18 +00:00
8588.txt add entry for 8588 (#8650) 2020-09-10 16:54:01 +00:00
8596.txt connect: all config entries pick up a meta field (#8596) 2020-09-02 19:22:37 +00:00
8601.txt connect: fix bug in preventing some namespaced config entry modifications (#8601) 2020-09-02 15:47:53 +00:00
8602.txt api: create fresh http client for unix sockets (#8602) 2020-09-06 16:28:56 +00:00
8606.txt Add support for -ca-path option in the connect envoy command (#8606) 2020-09-08 14:10:21 +00:00
8646.txt Merge pull request #8646 from hashicorp/common-intermediate-ttl 2020-09-15 19:04:27 +00:00
8685.txt Merge pull request #8685 from pierresouchay/do_not_flood_logs_with_Non-server_in_server-only_area 2020-09-15 21:58:29 +00:00
8704.txt use service datacenter for dns name (#8704) 2020-09-25 10:41:02 -05:00
8747.txt agent: when enable_central_service_config is enabled ensure agent reload doesn't revert check state to critical (#8747) 2020-09-24 21:24:51 +00:00
8774.txt Add capability for the v1/connect/ca/roots endpoint to return a PEM encoded certificate chain (#8774) 2020-10-09 14:43:59 +00:00
8784.txt Merge pull request #8784 from hashicorp/renew-intermediate-primary 2020-10-09 12:26:49 -07:00
8924.txt Merge pull request #8924 from ShimmerGlass/fix-sidecar-deregister-after-restart 2020-10-22 17:27:41 +00:00
8999.txt connect: update supported envoy point releases to 1.14.5, 1.13.6, 1.12.7, 1.11.2 for 1.8.x (#8999) 2020-10-22 13:26:51 -05:00
9024.txt changelog: fixup CVE link for 9024.txt 2020-10-23 16:13:36 -04:00
9240.txt Require operator:write to get Connect CA config (#9240) 2020-11-19 13:21:51 -07:00
changelog.tmpl Introducing changelog-gen (#8387) 2020-08-07 11:53:35 +02:00
note.tmpl changelog: fixup note.tmpl syntax 2020-10-23 16:10:58 -04:00