HIGH7.5
GHSA-25gf-8qrr-g78r
Hashicorp Consul Missing SSL Certificate Validation
Quick fix
GHSA-25gf-8qrr-g78r — github.com/hashicorp/consul: upgrade to the fixed version with the command below.
go get github.com/hashicorp/consul@v1.10.1Details
HashiCorp Consul before 1.10.1 (and Consul Enterprise) has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/hashicorp/consul
Introduced in:
0Fixed in: 1.10.1Fix
go get github.com/hashicorp/consul@v1.10.1References
- https://nvd.nist.gov/vuln/detail/CVE-2021-32574[ADVISORY]
- https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856[WEB]
- https://github.com/hashicorp/consul/releases/tag/v1.10.1[WEB]
- https://security.gentoo.org/glsa/202208-09[WEB]
- https://www.hashicorp.com/blog/category/consul[WEB]