CVE-2021-37219: High severity Hashicorp Consul vulnerability
HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.10.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.9.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.15
Event History
Frequently Asked Questions
What is the vulnerability ID for HashiCorp Consul and Consul Enterprise?
The vulnerability ID for HashiCorp Consul and Consul Enterprise is CVE-2021-37219.
What is the severity level of CVE-2021-37219?
CVE-2021-37219 has a severity level of 8.8 (High).
Which versions of HashiCorp Consul and Consul Enterprise are affected by CVE-2021-37219?
Versions 1.8.15, 1.9.0 to 1.9.9, and 1.10.0 to 1.10.2 of HashiCorp Consul and Consul Enterprise are affected by CVE-2021-37219.
How can I fix the vulnerability in HashiCorp Consul and Consul Enterprise?
The vulnerability in HashiCorp Consul and Consul Enterprise can be fixed by updating to version 1.8.15, 1.9.9, or 1.10.2.
Where can I find more information about CVE-2021-37219?
You can find more information about CVE-2021-37219 on the HashiCorp discussion forum, Gentoo Security Advisory, and HashiCorp blog.