CGA-93gv-hv4c-83gx

Published

Last updated

https://images.chainguard.dev/security/CGA-93gv-hv4c-83gx

Package

consul-1.15

Latest Update

Fixed

Fixed Version

1.15.11-r5

Aliases

CVE-2019-9764
GHSA-q7fx-wm2p-qfj8

Severity

7.4

High

CVSS V3

Summary

HashiCorp Consul vulnerable to Origin Validation Error

Description

HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.

References

https://nvd.nist.gov/vuln/detail/CVE-2019-9764
https://github.com/advisories/GHSA-q7fx-wm2p-qfj8
https://github.com/hashicorp/consul/issues/5519
https://github.com/hashicorp/consul/commit/7e11dd82aa8dae505b7307adcb68c9d3194b3b40
https://github.com/hashicorp/consul

Updates

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

CGA-93gv-hv4c-83gx

Severity

Summary

Description

References

Updates

Product

Why Chainguard

Customers

Company

Resources