{"id":"CVE-2018-19653","published":"2018-12-09T19:00:00Z","modified":"2024-08-05T11:44:20Z","title":"HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing…","vendor":null,"product":null,"tier":"tail","description":{"text":"HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01223,"percentile":0.687,"provenance":"source"},"cwes":[],"references":[{"url":"https://groups.google.com/forum/#%21topic/consul-tool/7TCw06oio0I","tags":["x_refsource_MISC"]},{"url":"https://github.com/hashicorp/consul/pull/5069","tags":["x_refsource_MISC"]}],"priority":{"score":13.7,"factors":[{"name":"EPSS percentile","points":13.74}]},"affected":[{"ecosystem":"Go","package":"github.com/hashicorp/consul","vulnerableRanges":[">=0.5.1, <1.4.1"],"patched":["1.4.1"],"from":["GHSA-4qvx-qq5w-695p","GO-2023-1850"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2433","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-github-com-hashicorp-consul-cve-2018-19653","children":[{"from":"CVE-2018-19653","to":"CVE-2019-9764","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["tlsutil/config.go"],"commits":["https://github.com/hashicorp/consul/commit/b64e8b262f80397eab4f39c6ae7e14683cb9f55c","https://github.com/hashicorp/consul/commit/7e11dd82aa8dae505b7307adcb68c9d3194b3b40"],"basis":"rarely changed file"}]},{"from":"CVE-2018-19653","to":"CVE-2021-37219","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["tlsutil/config.go"],"commits":["https://github.com/hashicorp/consul/commit/b64e8b262f80397eab4f39c6ae7e14683cb9f55c","https://github.com/hashicorp/consul/commit/3357e57dac9aadabd476f7a14973e47f003c4cf0","https://github.com/hashicorp/consul/commit/473edd1764b6739e2e4610ea5dede4c2bc6009d1"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2018-19653","published":"2018-12-09","fixed":"1.4.1","kev":false},{"cve":"CVE-2019-8336","published":"2019-03-05","fixed":"1.4.3","kev":false,"link":{"from":"CVE-2018-19653","to":"CVE-2019-8336","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/hashicorp/consul","fromFixed":"1.4.1","toFixed":"1.4.3","daysApart":86}]}},{"cve":"CVE-2019-9764","published":"2019-03-26","fixed":"1.4.4","kev":false},{"cve":"CVE-2019-12291","published":"2019-06-06","fixed":"1.5.1","kev":false}],"package":"Go:github.com/hashicorp/consul"}}