CVE-2021-36213

Published: Jul 17, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1.

Affected (4)

Products: Hashicorp: Consul

Hashicorp

1 product

Consul

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Hashicorp Consul	From 1.10.0 to 1.10.1
Hashicorp Consul	From 1.9.0 to 1.9.8
Hashicorp Consul	From 1.10.0 to 1.10.1
Hashicorp Consul	From 1.9.0 to 1.9.8

References (8)

https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-intentions-deny-action-fails-open-when-combined-with-default-deny-policy/26855

Source: cve@mitre.org

Vendor Advisory

https://github.com/hashicorp/consul/releases/tag/v1.10.1

Source: cve@mitre.org

Release NotesThird Party Advisory

https://security.gentoo.org/glsa/202208-09

Source: cve@mitre.org

Third Party Advisory

https://www.hashicorp.com/blog/category/consul

Source: cve@mitre.org

ProductVendor Advisory

https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-intentions-deny-action-fails-open-when-combined-with-default-deny-policy/26855

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://github.com/hashicorp/consul/releases/tag/v1.10.1

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://security.gentoo.org/glsa/202208-09

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.hashicorp.com/blog/category/consul

Source: af854a3a-2127-422b-91ae-364da2661108

ProductVendor Advisory

Timeline

No history available yet.