PT-2018-15031 · Hashicorp+1 · Hashicorp Consul+1

Pearkes · Publicado 2018-12-09 · Atualizado 2024-08-20 · CVE-2018-19653

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Consul versions 0.5.1 through 1.4.0

Description The issue arises from the improper documentation of the verify outgoing setting, allowing HashiCorp Consul to use cleartext agent-to-agent RPC communication. This affects versions 0.5.1 through 1.4.0. The vendor has provided reconfiguration steps to address this issue without requiring a software upgrade.

Recommendations For HashiCorp Consul versions 0.5.1 through 1.4.0, reconfigure the verify outgoing setting according to the vendor's provided instructions to prevent cleartext agent-to-agent RPC communication. As a temporary workaround, consider restricting the use of cleartext communication in the RPC until the reconfiguration is applied.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

ALT-PU-2019-1446

CVE-2018-19653

GHSA-4QVX-QQ5W-695P

GO-2023-1850

Produtos afetados

Alt Linux

Hashicorp Consul

Referências · 15

• https://github.com/hashicorp/consul · Nota
• https://github.com/hashicorp/consul/pull/5069 · Correção
• https://github.com/hashicorp/consul/commit/b64e8b262f80397eab4f39c6ae7e14683cb9f55c · Nota
• https://github.com/advisories/GHSA-4qvx-qq5w-695p · Nota
• https://ubuntu.com/security/CVE-2018-19653 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-19653 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-19653 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-19653 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-19653 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2018-19653 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-4qvx-qq5w-695p · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-19653 · Aviso do Fabricante
• https://groups.google.com/forum/#!topic/consul-tool/7TCw06oio0I · Nota
• https://osv.dev/vulnerability/GO-2023-1850 · Aviso do Fabricante
• https://groups.google.com/forum/#%21topic/consul-tool/7TCw06oio0I · Nota