[pkg-go] Bug#991719: consul: CVE-2021-32574

[Salvatore Bonaccorso]

Source: consul
Version: 1.8.7+dfsg1-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for consul.

CVE-2021-32574[0]:
| HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy
| proxy TLS configuration does not validate destination service identity
| in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and
| 1.10.1.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-32574
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32574
[1] https://github.com/hashicorp/consul/pull/10619
[2] https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856

Regards,
Salvatore