CVE-2021-36213: HashiCorp Consul L7 Application-Aware Intention Deny Action Bypass
Summary
CVE-2021-36213: HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Affects consul across 2 version ranges.
>= 1.9.0, < 1.9.8
>= 1.10.0, < 1.10.1
Fixed in 1.9.8 or 1.10.1, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-36213 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Consul is an open-source service mesh solution that provides a distributed, highly available, and scalable platform for service discovery, configuration, and segmentation. It enables secure communication between services in a microservices architecture. Consul Enterprise is the commercial version of Consul with additional features and support. Consul and Consul Enterprise versions 1.9.0 through 1.10.0 are affected by a vulnerability that impacts the default deny policy with a single L7 application-aware intention deny action. This vulnerability allows the intention to incorrectly fail open, bypassing the intended denial of L7 traffic and allowing L4 traffic instead.
Vulnerability Detail
The vulnerability in HashiCorp Consul and Consul Enterprise versions 1.9.0 through 1.10.0 arises from a flaw in the default deny policy with a single L7 application-aware intention deny action. Due to this flaw, the intention fails open, resulting in the unintended bypass of the denial of L7 traffic. As a consequence, L4 traffic is allowed, potentially leading to unauthorized access or other security risks. The vulnerability has a high severity rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). It has been assigned the CVE identifier CVE-2021-36213 and the GHSA identifier GHSA-8h2g-r292-j8xh.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.9.0, < 1.9.81.9.8 -
>= 1.10.0, < 1.10.11.10.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions of HashiCorp Consul or Consul Enterprise to mitigate the risk.
Conclusion
The vulnerability in HashiCorp Consul and Consul Enterprise versions 1.9.0 through 1.10.0 allows the bypass of the intended denial of L7 traffic, potentially leading to unauthorized access or other security risks. To mitigate this vulnerability, it is recommended to upgrade to the fixed versions of HashiCorp Consul or Consul Enterprise (1.9.8 or 1.10.1). For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for consul →
FAQ
HashiCorp Consul is an open-source service mesh solution that provides service discovery, configuration, and segmentation capabilities for microservices architectures.
The vulnerability allows the bypass of the intended denial of L7 traffic, potentially enabling unauthorized access or other security risks.
Versions 1.9.0 through 1.10.0 of HashiCorp Consul and Consul Enterprise are affected.
To fix this vulnerability, upgrade to version 1.9.8 if using Consul 1.9.x, or upgrade to version 1.10.1 if using Consul 1.10.x.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed versions.
Related vulnerabilities
Recent vulnerabilities recorded for consul.
