Vulnerabilities > CVE-2018-19653 - Cryptographic Issues vulnerability in Hashicorp Consul

CVSS 5.9 - MEDIUM

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

high complexity

hashicorp

CWE-310

NVD

Published: 2018-12-09

Updated: 2023-11-07

Summary

HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.

Vulnerable Configurations

Part	Description	Count
Application	Hashicorp Hashicorp Consul 0.5.1 Hashicorp Consul 0.5.2 Hashicorp Consul 0.6.0 Hashicorp Consul 0.6.1 Hashicorp Consul 0.6.2 Hashicorp Consul 0.6.3 Hashicorp Consul 0.6.4 Hashicorp Consul 0.6.5 Hashicorp Consul 0.7.0 Hashicorp Consul 0.7.1 Hashicorp Consul 0.7.2 Hashicorp Consul 0.7.3 Hashicorp Consul 0.7.4 Hashicorp Consul 0.7.5 Hashicorp Consul 0.8.0 Hashicorp Consul 0.8.1 Hashicorp Consul 0.8.2 Hashicorp Consul 0.8.3 Hashicorp Consul 0.8.4 Hashicorp Consul 0.8.5 Hashicorp Consul 0.9.0 Hashicorp Consul 0.9.0-Rc1 Hashicorp Consul 0.9.1 Hashicorp Consul 0.9.2 Hashicorp Consul 0.9.3 Hashicorp Consul 0.9.4 Hashicorp Consul 0.10.0 Hashicorp Consul 0.11.0 Hashicorp Consul 0.12.0 Hashicorp Consul 0.12.1 Hashicorp Consul 0.12.2 Hashicorp Consul 0.13.0 Hashicorp Consul 0.14.0 Hashicorp Consul 0.15.0 Hashicorp Consul 0.16.0 Hashicorp Consul 0.18.0 Hashicorp Consul 0.18.2 Hashicorp Consul 0.18.3 Hashicorp Consul 0.18.4 Hashicorp Consul 0.18.5 Hashicorp Consul 0.19.0 Hashicorp Consul 0.19.1 Hashicorp Consul 0.19.2 Hashicorp Consul 0.19.3 Hashicorp Consul 0.19.4 Hashicorp Consul 0.20.0 Hashicorp Consul 1.0.0 Hashicorp Consul 1.0.1 Hashicorp Consul 1.0.2 Hashicorp Consul 1.0.3 Hashicorp Consul 1.0.4 Hashicorp Consul 1.0.5 Hashicorp Consul 1.0.6 Hashicorp Consul 1.0.7 Hashicorp Consul 1.0.8 Hashicorp Consul 1.1.0 Hashicorp Consul 1.1.1 Hashicorp Consul 1.2.0 Hashicorp Consul 1.2.1 Hashicorp Consul 1.2.2 Hashicorp Consul 1.2.3 Hashicorp Consul 1.2.4 Hashicorp Consul 1.3.0 Hashicorp Consul 1.3.1 Hashicorp Consul 1.4.0	287

Common Weakness Enumeration (CWE)

CWE-310 - Cryptographic Issues

Common Attack Pattern Enumeration and Classification (CAPEC)

Signature Spoofing by Key Recreation
An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References