CVE-2021-32574

{"id": "CVE-2021-32574", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-07-17T18:15:07.723", "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/hashicorp/consul/releases/tag/v1.10.1", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.gentoo.org/glsa/202208-09", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.hashicorp.com/blog/category/consul", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1."}, {"lang": "es", "value": "HashiCorp Consul y Consul Enterprise versi\u00f3n 1.3.0 hasta la versi\u00f3n 1.10.0 La configuraci\u00f3n del proxy TLS de Envoy no valida la identidad del servicio de destino en el nombre alternativo del asunto codificado. Corregido en las versiones 1.8.14, 1.9.8 y 1.10.1"}], "lastModified": "2022-10-25T20:41:30.533", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "1CE7C620-26CF-448F-B050-39FFA83C7D55", "versionEndExcluding": "1.8.14", "versionStartIncluding": "1.3.0"}, {"criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "58878867-A000-4FD7-8E80-0D914A056CA9", "versionEndExcluding": "1.8.14", "versionStartIncluding": "1.3.0"}, {"criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "45B0891D-896C-46AA-AD6C-787318B837E3", "versionEndExcluding": "1.9.8", "versionStartIncluding": "1.9.0"}, {"criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "8F815B6E-D557-4A70-9928-E75EB12C880E", "versionEndExcluding": "1.9.8", "versionStartIncluding": "1.9.0"}, {"criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "AFBB4342-D380-496A-B38E-7446BEE108D9", "versionEndExcluding": "1.10.1", "versionStartIncluding": "1.10.0"}, {"criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "3A7B9301-1B89-4C79-8E6C-4FD747822096", "versionEndExcluding": "1.10.1", "versionStartIncluding": "1.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}