ArchLinux: 202107-69: consul: multiple issues

Advisories

Arch Linux Security Advisory ASA-202107-69
==========================================

Severity: Medium
Date    : 2021-07-27
CVE-ID  : CVE-2021-32574 CVE-2021-36213
Package : consul
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2171

Summary
=======

The package consul before version 1.9.8-1 is vulnerable to multiple
issues including access restriction bypass and certificate verification
bypass.

Resolution
==========

Upgrade to 1.9.8-1.

# pacman -Syu "consul>=1.9.8-1"

The problems have been fixed upstream in version 1.9.8.

Workaround
==========

None.

Description
===========

- CVE-2021-32574 (certificate verification bypass)

HashiCorp Consul before version 1.9.8 does not validate SSL
certificates correctly: xds does not ensure that the Subject
Alternative Name of an upstream is validated.

- CVE-2021-36213 (access restriction bypass)

In HashiCorp Consul before version 1.9.8, xds can generate a situation
where a single L7 deny intention (with a default deny policy) results
in an allow action.

Impact
======

A single L7 deny intention could erroneously result in an allow action,
leading to access restriction bypass. Furthermore, a malicious upstream
could present an invalid certificate.

References
==========

https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856
https://github.com/hashicorp/consul/issues/6364
https://github.com/hashicorp/consul/pull/10621
https://github.com/hashicorp/consul/pull/10623
https://github.com/hashicorp/consul/commit/2bca52fa88caedc2b6a7cc3627f3cd1f683c6d74
https://github.com/hashicorp/consul/commit/0b4fe4b7a2a7c400521248a0d548429963f4c614
https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-intentions-deny-action-fails-open-when-combined-with-default-deny-policy/26855
https://github.com/hashicorp/consul/pull/10619
https://github.com/hashicorp/consul/pull/10620
https://github.com/hashicorp/consul/commit/3ca24425ef7ad223077269a42041622f269ef5d0
https://security.archlinux.org/CVE-2021-32574
https://security.archlinux.org/CVE-2021-36213

ArchLinux: 202107-69: consul: multiple issues

July 30, 2021
The package consul before version 1.9.8-1 is vulnerable to multiple issues including access restriction bypass and certificate verification bypass

Summary

- CVE-2021-32574 (certificate verification bypass)
HashiCorp Consul before version 1.9.8 does not validate SSL certificates correctly: xds does not ensure that the Subject Alternative Name of an upstream is validated.
- CVE-2021-36213 (access restriction bypass)
In HashiCorp Consul before version 1.9.8, xds can generate a situation where a single L7 deny intention (with a default deny policy) results in an allow action.

Resolution

Upgrade to 1.9.8-1.
# pacman -Syu "consul>=1.9.8-1"
The problems have been fixed upstream in version 1.9.8.

References

https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856 https://github.com/hashicorp/consul/issues/6364 https://github.com/hashicorp/consul/pull/10621 https://github.com/hashicorp/consul/pull/10623 https://github.com/hashicorp/consul/commit/2bca52fa88caedc2b6a7cc3627f3cd1f683c6d74 https://github.com/hashicorp/consul/commit/0b4fe4b7a2a7c400521248a0d548429963f4c614 https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-intentions-deny-action-fails-open-when-combined-with-default-deny-policy/26855 https://github.com/hashicorp/consul/pull/10619 https://github.com/hashicorp/consul/pull/10620 https://github.com/hashicorp/consul/commit/3ca24425ef7ad223077269a42041622f269ef5d0 https://security.archlinux.org/CVE-2021-32574 https://security.archlinux.org/CVE-2021-36213

Severity
CVE-ID : CVE-2021-32574 CVE-2021-36213
Package : consul
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2171

Impact

A single L7 deny intention could erroneously result in an allow action, leading to access restriction bypass. Furthermore, a malicious upstream could present an invalid certificate.

Workaround

None.

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.