CVEvulnerability
CVE-2021-32574
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-07-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-295
Description
HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.
Affected configurations
• hashicorp consul (>= 1.3.0 < 1.8.14)
• hashicorp consul (>= 1.9.0 < 1.9.8)
• hashicorp consul (>= 1.10.0 < 1.10.1)
Related
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856 Vendor Advisory
- https://github.com/hashicorp/consul/releases/tag/v1.10.1 Third Party Advisory
- https://security.gentoo.org/glsa/202208-09 Third Party Advisory
- https://www.hashicorp.com/blog/category/consul Vendor Advisory
- https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856 Vendor Advisory
- https://github.com/hashicorp/consul/releases/tag/v1.10.1 Third Party Advisory
- https://security.gentoo.org/glsa/202208-09 Third Party Advisory
- https://www.hashicorp.com/blog/category/consul Vendor Advisory