PT-2021-6606 · Hashicorp+2 · Hashicorp Consul+3

Published 2021-07-15 · Updated 2024-08-21 · CVE-2021-32574

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Consul and Consul Enterprise versions 1.3.0 through 1.10.0

Description The issue is related to the absence of validation of the destination service identity in the encoded subject alternative name in the Envoy proxy TLS configuration. This allows a remote attacker to impact data integrity. The xds does not ensure that the Subject Alternative Name of an upstream is validated.

Recommendations For versions 1.3.0 through 1.7.13, update to version 1.8.14. For versions 1.8.0 through 1.9.7, update to version 1.9.8. For versions 1.10.0, update to version 1.10.1. As a temporary workaround, consider restricting access to the vulnerable xds component until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2021-3445

ALT-PU-2023-7106

ALT-PU-2024-8028

BDU:2022-01882

BIT-CONSUL-2021-32574

CVE-2021-32574

GHSA-25GF-8QRR-G78R

GO-2022-0894

Affected Products

Alt Linux

Hashicorp Consul Enterprise

Debian

Hashicorp Consul

References · 21

• https://osv.dev/vulnerability/BIT-consul-2021-32574 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-09 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32574 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32574 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-32574 · Vendor Advisory
• https://hashicorp.com/blog/category/consul · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32574 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32574 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-32574 · Security Note
• https://osv.dev/vulnerability/GO-2022-0894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32574 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-25gf-8qrr-g78r · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01882 · Security Note
• https://github.com/hashicorp/consul/releases/tag/v1.10.1 · Note