high7.5
CVE-2021-32574
Hashicorp Consul Missing SSL Certificate Validation
Impact
HashiCorp Consul before 1.10.1 (and Consul Enterprise) has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/hashicorp/consul | < 1.10.1 | 1.10.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Consul | from 1.3.0 before 1.8.14 from 1.9.0 before 1.9.8 from 1.10.0 before 1.10.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856
- https://github.com/hashicorp/consul/releases/tag/v1.10.1
- https://security.gentoo.org/glsa/202208-09
- https://www.hashicorp.com/blog/category/consul
- https://github.com/advisories/GHSA-25gf-8qrr-g78r
- https://nvd.nist.gov/vuln/detail/CVE-2021-32574