Vulnerability Details CVE-2021-36213
HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.011
EPSS Ranking 77.4%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-intentions-deny-action-fails-open-when-combined-with-default-deny-policy/26855
- https://github.com/hashicorp/consul/releases/tag/v1.10.1
- https://security.gentoo.org/glsa/202208-09
- https://www.hashicorp.com/blog/category/consul
- https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-intentions-deny-action-fails-open-when-combined-with-default-deny-policy/26855
- https://github.com/hashicorp/consul/releases/tag/v1.10.1
- https://security.gentoo.org/glsa/202208-09
- https://www.hashicorp.com/blog/category/consul
Products affected by CVE-2021-36213
-
cpe:2.3:a:hashicorp:consul:1.10.0
-
cpe:2.3:a:hashicorp:consul:1.9.0
-
cpe:2.3:a:hashicorp:consul:1.9.1
-
cpe:2.3:a:hashicorp:consul:1.9.2
-
cpe:2.3:a:hashicorp:consul:1.9.3
-
cpe:2.3:a:hashicorp:consul:1.9.4
-
cpe:2.3:a:hashicorp:consul:1.9.5
-
cpe:2.3:a:hashicorp:consul:1.9.6
-
cpe:2.3:a:hashicorp:consul:1.9.7