GHSA-q7fx-wm2p-qfj8 CVE-2019-9764 GO-2023-1853
HashiCorp Consul vulnerable to Origin Validation Error
- Severity
- 7.4 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 0.61%
- Chance of exploitation in the next 30 days. Higher than 49.21% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-346 Origin Validation Error
- Fix
1.4.4- Upgrade github.com/hashicorp/consul to this version or later
Description
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/hashicorp/consul | < 1.4.4 |
1.4.4 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/hashicorp/consul Go → 1.4.4
- go
go get github.com/hashicorp/consul@v1.4.4 && go mod tidy
Severity breakdown
CVSS 3.0 7.4
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-cpfq-66p2-336j Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication | Medium | Also affects github.com/hashicorp/consul |
| GHSA-qh7p-pfq3-677h Consul event endpoint is vulnerable to denial of service | Medium | Also affects github.com/hashicorp/consul |
| GHSA-7g3r-8c6v-hfmr Consul key/value endpoint is vulnerable to denial of service | Medium | Also affects github.com/hashicorp/consul |
| GHSA-99wr-c2px-grmh Hashicorp Consul Cross-site Scripting vulnerability | Medium | Also affects github.com/hashicorp/consul |
| GHSA-5c4w-8hhh-3c3h Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability | Medium | Also affects github.com/hashicorp/consul |
| GHSA-chgm-7r52-whjj Hashicorp Consul Path Traversal vulnerability | Medium | Also affects github.com/hashicorp/consul |
| GHSA-6m72-467w-94rh Privilege Escalation in HashiCorp Consul | Medium | Also affects github.com/hashicorp/consul |
| GHSA-496g-fr33-whrf Denial of service in HashiCorp Consul | High | Also affects github.com/hashicorp/consul |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor