PT-2019-19855 · Hashicorp+1 · Hashicorp Consul+1

Hanshasselberg · Published 2019-03-26 · Updated 2024-08-20 · CVE-2019-9764

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Consul version 1.4.3

Description The issue arises from a lack of server hostname verification for agent-to-agent TLS communication in HashiCorp Consul. This occurs even when the verify server hostname setting is set to true, causing the product to behave as if it were set to false.

Recommendations For HashiCorp Consul version 1.4.3, update to version 1.4.4 to resolve the issue. As a temporary workaround, consider disabling agent-to-agent TLS communication until the update can be applied.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

ALT-PU-2020-3391

ALT-PU-2020-3421

ALT-PU-2022-1256

CVE-2019-9764

GHSA-Q7FX-WM2P-QFJ8

GO-2023-1853

Affected Products

Alt Linux

Hashicorp Consul

References · 11

• 🔥 https://github.com/hashicorp/consul/issues/5519 · Exploit
• https://osv.dev/vulnerability/CVE-2019-9764 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-9764 · Security Note
• https://osv.dev/vulnerability/GO-2023-1853 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-9764 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9764 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9764 · Security Note
• https://osv.dev/vulnerability/GHSA-q7fx-wm2p-qfj8 · Vendor Advisory
• https://github.com/hashicorp/consul · Note
• https://github.com/hashicorp/consul/commit/7e11dd82aa8dae505b7307adcb68c9d3194b3b40 · Note
• https://github.com/advisories/GHSA-q7fx-wm2p-qfj8 · Note