HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-32574US | high7.5 | — | ||
HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fi… | ||||
02
references
External citations — patches, advisories, analysis.
- https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856ADVISORY
- https://github.com/hashicorp/consul/releases/tag/v1.10.1ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2021-32574WEB
- https://security.gentoo.org/glsa/202208-09ADVISORY
- https://www.hashicorp.com/blog/category/consulADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan