AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

ConsulGHSA-4qvx-qq5w-695p

HashiCorp Consul can use cleartext agent-to-agent RPC communication

Consul

CVE-2018-19653 · Published May 14, 2022 · updated Sep 10, 2026

Medium5.9
Fix: upgrade to 1.4.1 or later
GitHub advisory

HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
>= 0.5.1, < 1.4.11.4.1
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Also known as
CVE-2018-19653, GO-2023-1850

More Consul advisories

All Consul
Medium 6.1May 24, 2022HashiCorp Consul Cross-site Scripting vulnerabilityCVE-2020-25864fixed in 1.7.14 +2High 7.4May 13, 2022HashiCorp Consul vulnerable to Origin Validation ErrorCVE-2019-9764fixed in 1.4.4High 8.1May 13, 2022HashiCorp Consul Access Restriction BypassCVE-2019-8336fixed in 1.4.3High 7.5Apr 20, 2022Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vectorCVE-2022-29153fixed in 1.9.17 +2Medium 6.5Feb 25, 2022HashiCorp Consul Ingress Gateway Panic Can Shutdown ServersCVE-2022-24687fixed in 1.9.15 +2Medium 5.3Feb 15, 2022Denial of Service (DoS) in HashiCorp ConsulCVE-2020-12758fixed in 1.6.6 +1