HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.
The product does not validate, or incorrectly validates, a certificate.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Consul | Hashicorp | 1.3.0 (including) | 1.8.14 (excluding) |
| Consul | Hashicorp | 1.9.0 (including) | 1.9.8 (excluding) |
| Consul | Hashicorp | 1.10.0 (including) | 1.10.1 (excluding) |
| Consul | Ubuntu | bionic | * |
| Consul | Ubuntu | groovy | * |
| Consul | Ubuntu | hirsute | * |
| Consul | Ubuntu | impish | * |
| Consul | Ubuntu | kinetic | * |
| Consul | Ubuntu | trusty | * |
| Consul | Ubuntu | xenial | * |