PT-2021-21583 · Hashicorp+3 · Hashicorp Consul Enterprise+4

Published 2021-09-07 · Updated 2024-08-21 · CVE-2021-37219

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Consul and Consul Enterprise versions prior to 1.8.15 HashiCorp Consul and Consul Enterprise versions prior to 1.9.9 HashiCorp Consul and Consul Enterprise versions prior to 1.10.2

Description The issue allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation.

Recommendations For versions prior to 1.8.15, update to version 1.8.15 or later. For versions prior to 1.9.9, update to version 1.9.9 or later. For versions prior to 1.10.2, update to version 1.10.2 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2021-3445

ALT-PU-2023-7106

ALT-PU-2024-8028

BIT-CONSUL-2021-37219

CVE-2021-37219

GHSA-CCW8-7688-VQX4

GO-2022-0593

Affected Products

Alt Linux

Astra Linux

Hashicorp Consul Enterprise

Debian

Hashicorp Consul

References · 20

• https://cve.org/CVERecord?id=CVE-2021-37219 · Security Note
• https://osv.dev/vulnerability/GHSA-ccw8-7688-vqx4 · Vendor Advisory
• https://hashicorp.com/blog/category/consul · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-37219 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2021-22-consul-raft-rpc-privilege-escalation/29024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37219 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37219 · Vendor Advisory
• https://security.gentoo.org/glsa/202207-01 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-37219 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0593 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-consul-2021-37219 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-37219 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-37219 · Vendor Advisory
• https://github.com/hashicorp/consul · Note
• https://github.com/hashicorp/consul/pull/10925 · Note