PT-2021-21178 · Hashicorp · Hashicorp Consul Enterprise+1

Published 2021-07-17 · Updated 2024-08-21 · CVE-2021-36213

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Consul and Consul Enterprise versions 1.9.0 through 1.10.0

Description The issue arises when a default deny policy with a single L7 application-aware intention deny action is used, causing the intention to incorrectly fail open and allow L4 traffic. This occurs due to a situation generated by xds where a single L7 deny intention results in an allow action when a default deny policy is in place.

Recommendations For HashiCorp Consul and Consul Enterprise versions 1.9.0 through 1.9.7, update to version 1.9.8 to resolve the issue. For HashiCorp Consul and Consul Enterprise version 1.10.0, update to version 1.10.1 to resolve the issue.

Fix

Related Identifiers

BIT-CONSUL-2021-36213

CVE-2021-36213

GHSA-8H2G-R292-J8XH

GO-2022-0895

Affected Products

Hashicorp Consul Enterprise

Hashicorp Consul

References · 19

• https://osv.dev/vulnerability/GHSA-8h2g-r292-j8xh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36213 · Security Note
• https://osv.dev/vulnerability/BIT-consul-2021-36213 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-intentions-deny-action-fails-open-when-combined-with-default-deny-policy/26855 · Vendor Advisory
• https://hashicorp.com/blog/category/consul · Vendor Advisory
• https://security.gentoo.org/glsa/202208-09 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36213 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-36213 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-36213 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-36213 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0895 · Vendor Advisory
• https://github.com/hashicorp/consul · Note
• https://github.com/hashicorp/consul/releases/tag/v1.10.1 · Note
• https://t.me/cibsecurity/26238 · Telegram Post
• https://t.me/cvenotify/18293 · Telegram Post