Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2021-32574

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.

VectorNETWORK

PublishedJul 17, 2021, 18:15

Published Bycve@mitre.org

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/hashicorp/consul(Go)01.10.1N/A

References

https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856
https://github.com/hashicorp/consul/releases/tag/v1.10.1
https://security.gentoo.org/glsa/202208-09
https://www.hashicorp.com/blog/category/consul

Weakness Type

CWE-295

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK