Source: consul Version: 1.8.7+dfsg1-2 Severity: important Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for consul. CVE-2021-32574[0]: | HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy | proxy TLS configuration does not validate destination service identity | in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and | 1.10.1. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2021-32574 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32574 [1] https://github.com/hashicorp/consul/pull/10619 [2] https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856 Regards, Salvatore