AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ConsulGHSA-25gf-8qrr-g78r

Hashicorp Consul Missing SSL Certificate Validation

Consul

CVE-2021-32574 · Published Jul 19, 2021 · updated Sep 10, 2026

High7.5
Fix: upgrade to 1.10.1 or later
GitHub advisory

HashiCorp Consul before 1.10.1 (and Consul Enterprise) has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
< 1.10.11.10.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-295
Also known as
BIT-consul-2021-32574, CVE-2021-32574, GO-2022-0894

More Consul advisories

All Consul
Medium 6.5Sep 8, 2021Consul: missing authorizationCVE-2021-38698fixed in 1.8.15 +2High 8.8Sep 8, 2021HashiCorp Consul Privilege Escalation VulnerabilityCVE-2021-37219fixed in 1.8.15 +2Medium 5.3Jul 28, 2021Incorrect Authorization in HashiCorp ConsulCVE-2020-7955fixed in 1.6.3High 7.5Jul 19, 2021HashiCorp Consul L7 deny intention results in an allow actionCVE-2021-36213fixed in 1.10.1Medium 5.3Jun 23, 2021Incorrect Permission Assignment for Critical Resource in Hashicorp ConsulCVE-2020-12797fixed in 1.6.6 +1High 7.5May 18, 2021Allocation of Resources Without Limits or Throttling in Hashicorp ConsulCVE-2020-13250fixed in 1.6.6 +1