MEDIUM5.9
GHSA-4qvx-qq5w-695p
HashiCorp Consul can use cleartext agent-to-agent RPC communication
Quick fix
GHSA-4qvx-qq5w-695p — github.com/hashicorp/consul: upgrade to the fixed version with the command below.
go get github.com/hashicorp/consul@v1.4.1Details
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the `verify_outgoing` setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/hashicorp/consul
Introduced in:
0.5.1Fixed in: 1.4.1Fix
go get github.com/hashicorp/consul@v1.4.1References
- https://nvd.nist.gov/vuln/detail/CVE-2018-19653[ADVISORY]
- https://github.com/hashicorp/consul/pull/5069[WEB]
- https://github.com/hashicorp/consul/commit/b64e8b262f80397eab4f39c6ae7e14683cb9f55c[WEB]
- https://github.com/hashicorp/consul[PACKAGE]
- https://groups.google.com/forum/#!topic/consul-tool/7TCw06oio0I[WEB]