HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13.2.
Weakness
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Consul | Hashicorp | * | 1.11.9 (excluding) |
| Consul | Hashicorp | 1.12.0 (including) | 1.12.5 (excluding) |
| Consul | Hashicorp | 1.13.0 (including) | 1.13.2 (excluding) |
| Consul | Ubuntu | bionic | * |
| Consul | Ubuntu | focal | * |
| Consul | Ubuntu | kinetic | * |
| Consul | Ubuntu | mantic | * |
Potential Mitigations
References
- https://discuss.hashicorp.com
- https://discuss.hashicorp.com/t/hcsec-2022-20-consul-service-mesh-intention-bypass-with-malicious-certificate-signing-request/44628
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/
- https://discuss.hashicorp.com
- https://discuss.hashicorp.com/t/hcsec-2022-20-consul-service-mesh-intention-bypass-with-malicious-certificate-signing-request/44628
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/