AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ConsulGHSA-q7fx-wm2p-qfj8

HashiCorp Consul vulnerable to Origin Validation Error

Consul

CVE-2019-9764 · Published May 13, 2022 · updated Sep 10, 2026

High7.4
Fix: upgrade to 1.4.4 or later
GitHub advisory

HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/consul
Go
< 1.4.41.4.4
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-346
Also known as
CVE-2019-9764, GO-2023-1853

More Consul advisories

All Consul
Medium 6.1May 24, 2022HashiCorp Consul Cross-site Scripting vulnerabilityCVE-2020-25864fixed in 1.7.14 +2Medium 5.9May 14, 2022HashiCorp Consul can use cleartext agent-to-agent RPC communicationCVE-2018-19653fixed in 1.4.1High 8.1May 13, 2022HashiCorp Consul Access Restriction BypassCVE-2019-8336fixed in 1.4.3High 7.5Apr 20, 2022Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vectorCVE-2022-29153fixed in 1.9.17 +2Medium 6.5Feb 25, 2022HashiCorp Consul Ingress Gateway Panic Can Shutdown ServersCVE-2022-24687fixed in 1.9.15 +2Medium 5.3Feb 15, 2022Denial of Service (DoS) in HashiCorp ConsulCVE-2020-12758fixed in 1.6.6 +1