Arch Linux Security Advisory ASA-202107-69 ========================================== Severity: Medium Date : 2021-07-27 CVE-ID : CVE-2021-32574 CVE-2021-36213 Package : consul Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2171 Summary ======= The package consul before version 1.9.8-1 is vulnerable to multiple issues including access restriction bypass and certificate verification bypass. Resolution ========== Upgrade to 1.9.8-1. # pacman -Syu "consul>=1.9.8-1" The problems have been fixed upstream in version 1.9.8. Workaround ========== None. Description =========== - CVE-2021-32574 (certificate verification bypass) HashiCorp Consul before version 1.9.8 does not validate SSL certificates correctly: xds does not ensure that the Subject Alternative Name of an upstream is validated. - CVE-2021-36213 (access restriction bypass) In HashiCorp Consul before version 1.9.8, xds can generate a situation where a single L7 deny intention (with a default deny policy) results in an allow action. Impact ====== A single L7 deny intention could erroneously result in an allow action, leading to access restriction bypass. Furthermore, a malicious upstream could present an invalid certificate. References ========== https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configurati... https://github.com/hashicorp/consul/issues/6364 https://github.com/hashicorp/consul/pull/10621 https://github.com/hashicorp/consul/pull/10623 https://github.com/hashicorp/consul/commit/2bca52fa88caedc2b6a7cc3627f3cd1f6... https://github.com/hashicorp/consul/commit/0b4fe4b7a2a7c400521248a0d54842996... https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-int... https://github.com/hashicorp/consul/pull/10619 https://github.com/hashicorp/consul/pull/10620 https://github.com/hashicorp/consul/commit/3ca24425ef7ad223077269a42041622f2... https://security.archlinux.org/CVE-2021-32574 https://security.archlinux.org/CVE-2021-36213