Critical TLS Configuration Vulnerability in HashiCorp Consul: CVE-2021-32574
Summary
CVE-2021-32574: HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Affects consul versions < db839f18ba4796df77601bfe9873756ed340525d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Consul is a widely used tool for service networking, enabling service discovery, configuration, and segmentation functionalities. It is designed to facilitate the management of distributed applications and microservices. The vulnerability in question affects versions 1.3.0 through 1.10.0 of Consul and Consul Enterprise, specifically within the Envoy proxy's TLS configuration, which fails to validate the destination service identity in the encoded subject alternative name.
Vulnerability Detail
CVE-2021-32574 arises from a flaw in the TLS configuration of the Envoy proxy used in HashiCorp Consul. This vulnerability allows an attacker to potentially impersonate a service by exploiting the lack of validation of the destination service identity. The ramifications of this vulnerability include unauthorized access to sensitive data and the possibility of man-in-the-middle attacks, which can compromise the integrity and confidentiality of communications within the network. The issue was introduced in versions 1.3.0 through 1.10.0 and has been addressed in subsequent releases.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement additional network security measures, such as restricting access to the Consul service and monitoring for unusual activity. However, upgrading to a fixed version is strongly recommended for long-term security.
Conclusion
CVE-2021-32574 is a significant vulnerability in HashiCorp Consul that can lead to serious security risks if not addressed. Users are strongly encouraged to upgrade to the fixed versions to ensure the integrity and security of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for consul →
FAQ
CVE-2021-32574 is a vulnerability in HashiCorp Consul that affects the TLS configuration of the Envoy proxy, allowing potential impersonation of services.
The vulnerability affects HashiCorp Consul and Consul Enterprise versions 1.3.0 through 1.10.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2021-32574 is 7.5, indicating a high severity level.
If immediate upgrading is not possible, implement network security measures to restrict access to the Consul service and monitor for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for consul.
