New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security] Secvuln 8633 Consul configuration allowed repeated keys #21908

Merged

sarahalsmiller merged 14 commits into main from SECVULN-8633-TOB-CONSUL24-17-Consul-configuration-allows-repeated-keys

Nov 14, 2024

Member

sarahalsmiller commented Oct 31, 2024

Description

Due to a known issue in hcl v1,
There is a potential for old unparsed rules to be in the cache, so I added an optional route to replicate the old behavior to maintain backwards compatibility when reading unparsed policies from the cache.

Testing & Reproduction steps

New tests pass

Links

hashicorp/hcl#704 Original HCL PR

PR Checklist

[ X] updated test coverage
external facing docs updated
appropriate backport labels added
not a security concern

sarahalsmiller added the backport/all label

sarahalsmiller requested a review from dduzgun-security

October 31, 2024 16:17

sarahalsmiller requested a review from a team as a code owner

October 31, 2024 16:17

github-actions bot added theme/acls pr/dependencies labels

sarahalsmiller force-pushed the SECVULN-8633-TOB-CONSUL24-17-Consul-configuration-allows-repeated-keys branch from 1938f0b to ead5aa5 Compare

October 31, 2024 16:25

sarahalsmiller commented

View reviewed changes

acl/policy.go Outdated Show resolved Hide resolved

sarahalsmiller force-pushed the SECVULN-8633-TOB-CONSUL24-17-Consul-configuration-allows-repeated-keys branch 2 times, most recently from f25341c to 6160a2c Compare

November 5, 2024 20:32

sarahalsmiller and others added 14 commits

November 7, 2024 16:30


          upgrade hcl package and account for possiblity of duplicates existing…

7673eae

… already in the cache


          upgrade to new tag

b34f610


          add defensive line to prevent potential forever loop

31de425


          o mod tidy and changelog

0299f95


          Update acl/policy.go

f816fcc


          fix raft reversion

64af496


          go mod tidy

637561f


          fix test

994716d


          remove duplicate key in test

0baa3c9


          remove duplicates from test cases

05eecce


          clean up

18e9efa


          go mod tidy

c7ab56a


          go mod tidy

ae6fe96


          pull in new hcl tag

1cc3eb2

sarahalsmiller force-pushed the SECVULN-8633-TOB-CONSUL24-17-Consul-configuration-allows-repeated-keys branch from c4cbb00 to 1cc3eb2 Compare

November 7, 2024 22:30

sophie-gairo approved these changes

View reviewed changes

dduzgun-security approved these changes

View reviewed changes

Collaborator

dduzgun-security left a comment

LGTM! Awesome work on that

sarahalsmiller merged commit 32ce338 into main

94 checks passed

sarahalsmiller deleted the SECVULN-8633-TOB-CONSUL24-17-Consul-configuration-allows-repeated-keys branch

November 14, 2024 15:57

hc-github-team-consul-core added backport/1.20 backport/ent/1.15 labels

hc-github-team-consul-core added backport/ent/1.18 backport/ent/1.19 labels

hc-github-team-consul-core mentioned this pull request

Backport of [Security] Secvuln 8633 Consul configuration allowed repeated keys into release/1.20.x #21943

Merged

3 tasks

Collaborator

hc-github-team-consul-core commented Nov 15, 2024

📣 Hi @sarahalsmiller! a backport is missing for this PR [21908] for versions [1.15,1.18,1.19,1.20] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

3 similar comments

Collaborator

hc-github-team-consul-core commented Nov 16, 2024

📣 Hi @sarahalsmiller! a backport is missing for this PR [21908] for versions [1.15,1.18,1.19,1.20] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

Collaborator

hc-github-team-consul-core commented Nov 17, 2024

📣 Hi @sarahalsmiller! a backport is missing for this PR [21908] for versions [1.15,1.18,1.19,1.20] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

Collaborator

hc-github-team-consul-core commented Nov 18, 2024

📣 Hi @sarahalsmiller! a backport is missing for this PR [21908] for versions [1.15,1.18,1.19,1.20] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

Collaborator

hc-github-team-consul-core commented Nov 19, 2024

📣 Hi @sarahalsmiller! a backport is missing for this PR [21908] for versions [1.15,1.20] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

Collaborator

hc-github-team-consul-core commented Nov 20, 2024

📣 Hi @sarahalsmiller! a backport is missing for this PR [21908] for versions [1.20] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

5 similar comments

Collaborator

hc-github-team-consul-core commented Nov 21, 2024

📣 Hi @sarahalsmiller! a backport is missing for this PR [21908] for versions [1.20] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

Collaborator

hc-github-team-consul-core commented Nov 22, 2024

📣 Hi @sarahalsmiller! a backport is missing for this PR [21908] for versions [1.20] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

Collaborator

hc-github-team-consul-core commented Nov 23, 2024

📣 Hi @sarahalsmiller! a backport is missing for this PR [21908] for versions [1.20] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

Collaborator

hc-github-team-consul-core commented Nov 24, 2024

📣 Hi @sarahalsmiller! a backport is missing for this PR [21908] for versions [1.20] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

Collaborator

hc-github-team-consul-core commented Nov 25, 2024

📣 Hi @sarahalsmiller! a backport is missing for this PR [21908] for versions [1.20] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

sarahalsmiller removed backport/ent/1.15 backport/ent/1.18 backport/1.20 backport/ent/1.19 labels

nathancoleman mentioned this pull request

Fix duplicate key in connect-inject ACL policy hashicorp/consul-k8s#4434

Merged

2 tasks

This was referenced Nov 27, 2024

Backport of Fix duplicate key in connect-inject ACL policy into release/1.4.x hashicorp/consul-k8s#4435

Merged

Backport of Fix duplicate key in connect-inject ACL policy into release/1.5.x hashicorp/consul-k8s#4436

Merged

Backport of Fix duplicate key in connect-inject ACL policy into release/1.6.x hashicorp/consul-k8s#4437

Merged

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport/all pr/dependencies theme/acls