CVE-2021-36213 — Hashicorp Consul vulnerability

6 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.8%
top 26.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Hashicorp ConsulHashicorp ConsulDebian Consul
Timeline
PublishedJul 17
Latest updateAug 21

Description

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDhashicorp/consul1.9.0 — 1.9.8+1
▶debiandebian/consul

🔴Vulnerability Details

4
OSV
HashiCorp Consul L7 deny intention results in an allow action in github.com/hashicorp/consul↗2024-08-21
▶
GHSA
HashiCorp Consul L7 deny intention results in an allow action↗2021-07-19
▶
OSV
HashiCorp Consul L7 deny intention results in an allow action↗2021-07-19
▶
OSV
CVE-2021-36213: HashiCorp Consul and Consul Enterprise 1↗2021-07-17
▶

📋Vendor Advisories

1
Debian
CVE-2021-36213: consul - HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy ...↗2021
▶