6.7 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
52.8%
HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.
discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856
github.com/hashicorp/consul/releases/tag/v1.10.1
security.gentoo.org/glsa/202208-09
www.hashicorp.com/blog/category/consul