CVE-2021-32574 | BDVDB-2026-157167 Detail

Description#

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.hashicorp.com/blog/category/consul
https://github.com/hashicorp/consul/releases/tag/v1.10.1
https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856
https://security.gentoo.org/glsa/202208-09

Exploit#

No public exploit known

History#

Version 12021-07-17Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.