Remote Yes

Type Certificate verification bypass

Description

HashiCorp Consul before version 1.9.8 does not validate SSL certificates correctly: xds does not ensure that the Subject Alternative Name of an upstream is validated.

AVG-2171 consul 1.9.7-1 Medium Vulnerable

https://github.com/hashicorp/consul/releases/tag/v1.9.8
https://github.com/hashicorp/consul/issues/6364
https://github.com/hashicorp/consul/pull/10621
https://github.com/hashicorp/consul/pull/10623
https://github.com/hashicorp/consul/commit/2bca52fa88caedc2b6a7cc3627f3cd1f683c6d74
https://github.com/hashicorp/consul/commit/0b4fe4b7a2a7c400521248a0d548429963f4c614