Arch Linux Security Advisory ASA-202107-69
=========================================
Severity: Medium
Date    : 2021-07-27
CVE-ID  : CVE-2021-32574 CVE-2021-36213
Package : consul
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2171

Summary
======
The package consul before version 1.9.8-1 is vulnerable to multiple
issues including access restriction bypass and certificate verification
bypass.

Resolution
=========
Upgrade to 1.9.8-1.

# pacman -Syu "consul>=1.9.8-1"

The problems have been fixed upstream in version 1.9.8.

Workaround
=========
None.

Description
==========
- CVE-2021-32574 (certificate verification bypass)

HashiCorp Consul before version 1.9.8 does not validate SSL
certificates correctly: xds does not ensure that the Subject
Alternative Name of an upstream is validated.

- CVE-2021-36213 (access restriction bypass)

In HashiCorp Consul before version 1.9.8, xds can generate a situation
where a single L7 deny intention (with a default deny policy) results
in an allow action.

Impact
=====
A single L7 deny intention could erroneously result in an allow action,
leading to access restriction bypass. Furthermore, a malicious upstream
could present an invalid certificate.

References
=========
https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856
https://github.com/hashicorp/consul/issues/6364
https://github.com/hashicorp/consul/pull/10621
https://github.com/hashicorp/consul/pull/10623
https://github.com/hashicorp/consul/commit/2bca52fa88caedc2b6a7cc3627f3cd1f683c6d74
https://github.com/hashicorp/consul/commit/0b4fe4b7a2a7c400521248a0d548429963f4c614
https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-intentions-deny-action-fails-open-when-combined-with-default-deny-policy/26855
https://github.com/hashicorp/consul/pull/10619
https://github.com/hashicorp/consul/pull/10620
https://github.com/hashicorp/consul/commit/3ca24425ef7ad223077269a42041622f269ef5d0
https://security.archlinux.org/CVE-2021-32574
https://security.archlinux.org/CVE-2021-36213