GHSA-4qvx-qq5w-695p

ghsaUSosv

HashiCorp Consul can use cleartext agent-to-agent RPC communication

view advisory published 2022-05-14Licence: CC-BY-4.0

HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the `verify_outgoing` setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-19653US	medium5.9	1.22% (69th)	—	2018-12-09
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided…

references

External citations — patches, advisories, analysis.

https://github.com/hashicorp/consulPACKAGE
https://github.com/hashicorp/consul/commit/b64e8b262f80397eab4f39c6ae7e14683cb9f55cWEB
https://github.com/hashicorp/consul/pull/5069WEB
https://groups.google.com/forum/#!topic/consul-tool/7TCw06oio0IWEB
https://nvd.nist.gov/vuln/detail/CVE-2018-19653ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan