DEBIAN-CVE-2021-32574

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2021-32574

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-32574.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2021-32574

Upstream

CVE-2021-32574

Published

2021-07-17T18:15:07.723Z

Modified

2025-11-20T10:15:02.179557Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.

References

https://security-tracker.debian.org/tracker/CVE-2021-32574

Affected packages

Debian:11 / consul

Package

Name: consul
Purl: pkg:deb/debian/consul?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.8.7+dfsg1-2

1.8.7+dfsg1-3

1.8.7+dfsg1-4

1.8.7+dfsg1-5

1.8.7+dfsg1-6

1.9.17+dfsg2-1

1.10.12+dfsg1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-32574.json"