CVE-2021-32574: High severity hashicorp consul vulnerability
HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-32574?
CVE-2021-32574 is a vulnerability in HashiCorp Consul and Consul Enterprise versions 1.3.0 through 1.10.0 where the Envoy proxy TLS configuration does not validate destination service identity.
What is the severity of CVE-2021-32574?
CVE-2021-32574 has a severity level of 7.5, which is considered high.
How does CVE-2021-32574 affect HashiCorp Consul and Consul Enterprise?
CVE-2021-32574 affects HashiCorp Consul and Consul Enterprise versions 1.3.0 through 1.10.0.
How can I fix CVE-2021-32574?
To fix CVE-2021-32574, update your HashiCorp Consul or Consul Enterprise installation to version 1.8.14, 1.9.8, or 1.10.1, as these versions contain the fix.
Where can I find more information about CVE-2021-32574?
You can find more information about CVE-2021-32574 in the following references: [1] [2] [3]