Service Mesh Intention Bypass in HashiCorp Consul and Consul Enterprise

CVE-2022-40716

Summary

HashiCorp Consul and Consul Enterprise versions up to 1.11.8, 1.12.4, and 1.13.1 are affected by a vulnerability that allows attackers to leverage privileged access to bypass service mesh intentions. This occurs due to the lack of validation for multiple Subject Alternative Name (SAN) URI values in Certificate Signing Requests (CSRs) on the internal RPC endpoint. The issue has been addressed in subsequent releases, specifically versions 1.11.9, 1.12.5, and 1.13.2, reinforcing the importance of timely software updates to mitigate such security risks.

References