GitHub Advisoryadvisory · Go
GHSA-25gf-8qrr-g78r Hashicorp Consul Missing SSL Certificate Validation
HIGH
Official page ↗
- Aliases
- CVE-2021-32574
- Ecosystem
- Go
- Packages
- github.com/hashicorp/consul
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-295
- Reviewed
- 2021-07-19
Affected packages
• Go github.com/hashicorp/consul: < 1.10.1 → fixed in 1.10.1
Description
HashiCorp Consul before 1.10.1 (and Consul Enterprise) has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated.
Related
Alias · CVE (1)
- CVE-2021-32574 HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in… vulnerability
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-32574 advisory
- https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856 web
- https://github.com/hashicorp/consul/releases/tag/v1.10.1 web
- https://security.gentoo.org/glsa/202208-09 web
- https://www.hashicorp.com/blog/category/consul web