GHSA-25gf-8qrr-g78r

Suggest an improvement
Source
https://github.com/advisories/GHSA-25gf-8qrr-g78r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/07/GHSA-25gf-8qrr-g78r/GHSA-25gf-8qrr-g78r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-25gf-8qrr-g78r
Aliases
Published
2021-07-19T21:21:03Z
Modified
2024-06-21T08:12:25.976064Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
Hashicorp Consul Missing SSL Certificate Validation
Details

HashiCorp Consul before 1.10.1 (and Consul Enterprise) has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated.

References

Affected packages

Go / github.com/hashicorp/consul

Package

Name
github.com/hashicorp/consul
View open source insights on deps.dev
Purl
pkg:golang/github.com/hashicorp/consul

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.10.1