{"id":"CVE-2021-37219","published":"2021-09-07T11:33:26Z","modified":"2024-08-04T01:16:03Z","title":"HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed…","vendor":null,"product":null,"tier":"tail","description":{"text":"HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01149,"percentile":0.6687,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.hashicorp.com/blog/category/consul","tags":["x_refsource_MISC"]},{"url":"https://discuss.hashicorp.com/t/hcsec-2021-22-consul-raft-rpc-privilege-escalation/29024","tags":["x_refsource_MISC"]},{"url":"https://security.gentoo.org/glsa/202207-01","tags":["vendor-advisory","x_refsource_GENTOO"]}],"priority":{"score":13.4,"factors":[{"name":"EPSS percentile","points":13.37}]},"affected":[{"ecosystem":"Go","package":"github.com/hashicorp/consul","vulnerableRanges":[">=1.10.1, <1.10.2",">=1.9.0, <1.9.9","<1.8.15"],"patched":["1.10.2","1.9.9","1.8.15"],"from":["GHSA-ccw8-7688-vqx4","GO-2022-0593"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-2037","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-25864","published":"2021-04-20","fixed":"1.9.5","kev":false,"link":{"from":"CVE-2020-25864","to":"CVE-2021-37219","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/hashicorp/consul","fromFixed":"1.9.5","toFixed":"1.9.9","daysApart":140}]}},{"cve":"CVE-2021-32574","published":"2021-07-17","fixed":"1.10.1","kev":false,"link":{"from":"CVE-2021-32574","to":"CVE-2021-37219","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/hashicorp/consul","fromFixed":"1.10.1","toFixed":"1.10.2","daysApart":52}]}},{"cve":"CVE-2021-36213","published":"2021-07-17","fixed":"1.10.1","kev":false},{"cve":"CVE-2021-37219","published":"2021-09-07","fixed":"1.10.2","kev":false},{"cve":"CVE-2021-38698","published":"2021-09-07","fixed":"1.10.2","kev":false},{"cve":"CVE-2022-24687","published":"2022-02-24","fixed":"1.11.3","kev":false},{"cve":"CVE-2022-29153","published":"2022-04-19","fixed":"1.11.5","kev":false}],"package":"Go:github.com/hashicorp/consul"}}