PT-2018-15031 · Hashicorp+1 · Hashicorp Consul+1

Pearkes · Published 2018-12-09 · Updated 2024-08-20 · CVE-2018-19653

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Consul versions 0.5.1 through 1.4.0

Description The issue arises from the improper documentation of the verify outgoing setting, allowing HashiCorp Consul to use cleartext agent-to-agent RPC communication. This affects versions 0.5.1 through 1.4.0. The vendor has provided reconfiguration steps to address this issue without requiring a software upgrade.

Recommendations For HashiCorp Consul versions 0.5.1 through 1.4.0, reconfigure the verify outgoing setting according to the vendor's provided instructions to prevent cleartext agent-to-agent RPC communication. As a temporary workaround, consider restricting the use of cleartext communication in the RPC until the reconfiguration is applied.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

ALT-PU-2019-1446

CVE-2018-19653

GHSA-4QVX-QQ5W-695P

GO-2023-1850

Affected Products

Alt Linux

Hashicorp Consul

References · 15

• https://github.com/hashicorp/consul/pull/5069 · Patch
• https://ubuntu.com/security/CVE-2018-19653 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-19653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19653 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19653 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-19653 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-19653 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4qvx-qq5w-695p · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-19653 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1850 · Vendor Advisory
• https://github.com/hashicorp/consul · Note
• https://github.com/hashicorp/consul/commit/b64e8b262f80397eab4f39c6ae7e14683cb9f55c · Note
• https://github.com/advisories/GHSA-4qvx-qq5w-695p · Note
• https://groups.google.com/forum/#!topic/consul-tool/7TCw06oio0I · Note
• https://groups.google.com/forum/#%21topic/consul-tool/7TCw06oio0I · Note