Detections
Analytics

CVE-2021-32574

high

Description

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.

References

https://security.gentoo.org/glsa/202208-09

https://github.com/hashicorp/consul/releases/tag/v1.10.1

https://github.com/advisories/GHSA-25gf-8qrr-g78r

https://www.hashicorp.com/blog/category/consul

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1430

https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856

Details

Source: Mitre, NVD

Published: 2021-07-17

Updated: 2026-06-17

Named Vulnerability: GO-2022-0894Named Vulnerability: GHSA-25gf-8qrr-g78r

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Severity: High

EPSS

EPSS: 0.01457