Hashicorp Consul Missing SSL Certificate Validation

HIGH 7.5CVE-2021-32574 · BIT-consul-2021-32574 · GHSA-25gf-8qrr-g78r · Published 17/07/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/hashicorp/consul Go	`< 1.10.1`	`1.10.1`
consul hashicorp	`≥ 1.10.0, < 1.10.1≥ 1.3.0, < 1.8.14≥ 1.9.0, < 1.9.8`	`1.10.11.8.141.9.8`

Description

HashiCorp Consul before 1.10.1 (and Consul Enterprise) has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated.

NVD description

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.

References

nvd.nist.gov/vuln/detail/CVE-2021-32574 · ADVISORY
discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856 · WEB
hashicorp/consul release v1.10.1 · WEB
security.gentoo.org/glsa/202208-09 · WEB
hashicorp.com/blog/category/consul · WEB
GitHub Advisory GHSA-25gf-8qrr-g78r · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free