CVE-2018-19653: HashiCorp Consul can use cleartext agent-to-agent RPC communication

May 14, 2022 (updated June 9, 2023)

HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.

References

github.com/advisories/GHSA-4qvx-qq5w-695p
github.com/hashicorp/consul/commit/b64e8b262f80397eab4f39c6ae7e14683cb9f55c
github.com/hashicorp/consul/pull/5069
groups.google.com/forum/
nvd.nist.gov/vuln/detail/CVE-2018-19653

Code Behaviors & Features

Detect and mitigate CVE-2018-19653 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →