{"id":"CVE-2019-9764","published":"2019-03-26T13:05:51Z","modified":"2024-08-04T22:01:54Z","title":"HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication","vendor":null,"product":null,"tier":"tail","description":{"text":"HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0061,"percentile":0.49102,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/hashicorp/consul/issues/5519","tags":["x_refsource_MISC"]}],"priority":{"score":9.8,"factors":[{"name":"EPSS percentile","points":9.82}]},"affected":[{"ecosystem":"Go","package":"github.com/hashicorp/consul","vulnerableRanges":["<1.4.4"],"patched":["1.4.4"],"from":["GHSA-q7fx-wm2p-qfj8","GO-2023-1853"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4910","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-github-com-hashicorp-consul-cve-2018-19653","parents":[{"from":"CVE-2018-19653","to":"CVE-2019-9764","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["tlsutil/config.go"],"commits":["https://github.com/hashicorp/consul/commit/b64e8b262f80397eab4f39c6ae7e14683cb9f55c","https://github.com/hashicorp/consul/commit/7e11dd82aa8dae505b7307adcb68c9d3194b3b40"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2019-9764","to":"CVE-2021-37219","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["tlsutil/config.go"],"commits":["https://github.com/hashicorp/consul/commit/7e11dd82aa8dae505b7307adcb68c9d3194b3b40","https://github.com/hashicorp/consul/commit/3357e57dac9aadabd476f7a14973e47f003c4cf0","https://github.com/hashicorp/consul/commit/473edd1764b6739e2e4610ea5dede4c2bc6009d1"],"basis":"shared function","functions":["SpecificDC"]}]}],"packageHistory":[{"cve":"CVE-2018-19653","published":"2018-12-09","fixed":"1.4.1","kev":false},{"cve":"CVE-2019-8336","published":"2019-03-05","fixed":"1.4.3","kev":false,"link":{"from":"CVE-2019-8336","to":"CVE-2019-9764","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/hashicorp/consul","fromFixed":"1.4.3","toFixed":"1.4.4","daysApart":21}]}},{"cve":"CVE-2019-9764","published":"2019-03-26","fixed":"1.4.4","kev":false},{"cve":"CVE-2019-12291","published":"2019-06-06","fixed":"1.5.1","kev":false,"link":{"from":"CVE-2019-9764","to":"CVE-2019-12291","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/hashicorp/consul","fromFixed":"1.4.4","toFixed":"1.5.1","daysApart":72}]}},{"cve":"CVE-2020-7219","published":"2020-01-31","fixed":"1.6.3","kev":false},{"cve":"CVE-2020-7955","published":"2020-01-31","fixed":"1.6.3","kev":false}],"package":"Go:github.com/hashicorp/consul"}}