Описание
Hashicorp Consul Missing SSL Certificate Validation
HashiCorp Consul before 1.10.1 (and Consul Enterprise) has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2021-32574
- https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856
- https://github.com/hashicorp/consul/releases/tag/v1.10.1
- https://security.gentoo.org/glsa/202208-09
- https://www.hashicorp.com/blog/category/consul
Пакеты
github.com/hashicorp/consul
< 1.10.1
1.10.1
Связанные уязвимости
HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.
HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.
HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy prox ...
Уязвимость прокси-сервера Envoy инструмента настройки сервисов Consul, позволяющая нарушителю оказать воздействие на целостность данных