GHSA-25gf-8qrr-g78r

Hashicorp Consul Missing SSL Certificate Validation

Source: GitHub Advisory Database (reviewed) High CVE-2021-32574

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp/consul	< 1.10.1	1.10.1

Details

As written in the advisory (Markdown source, shown as plain text).

HashiCorp Consul before 1.10.1 (and Consul Enterprise) has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-32574 advisory
https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-name… web
https://github.com/hashicorp/consul/releases/tag/v1.10.1 web
https://security.gentoo.org/glsa/202208-09 web
https://www.hashicorp.com/blog/category/consul web