{"id":"CVE-2018-19653","published":"2018-12-09T19:00:00Z","modified":"2024-08-05T11:44:20Z","title":"HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing…","vendor":null,"product":null,"tier":"tail","description":{"text":"HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01223,"percentile":0.68779,"provenance":"source"},"cwes":[],"references":[{"url":"https://groups.google.com/forum/#%21topic/consul-tool/7TCw06oio0I","tags":["x_refsource_MISC"]},{"url":"https://github.com/hashicorp/consul/pull/5069","tags":["x_refsource_MISC"]}],"priority":{"score":13.8,"factors":[{"name":"EPSS percentile","points":13.76}]},"affected":[{"ecosystem":"Go","package":"github.com/hashicorp/consul","vulnerableRanges":[">=0.5.1, <1.4.1"],"patched":["1.4.1"],"from":["GHSA-4qvx-qq5w-695p","GO-2023-1850"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2433","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2018-19653","published":"2018-12-09","fixed":"1.4.1","kev":false},{"cve":"CVE-2019-8336","published":"2019-03-05","fixed":"1.4.3","kev":false,"link":{"from":"CVE-2018-19653","to":"CVE-2019-8336","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/hashicorp/consul","fromFixed":"1.4.1","toFixed":"1.4.3","daysApart":86}]}},{"cve":"CVE-2019-9764","published":"2019-03-26","fixed":"1.4.4","kev":false},{"cve":"CVE-2019-12291","published":"2019-06-06","fixed":"1.5.1","kev":false}],"package":"Go:github.com/hashicorp/consul"}}