CVE-2019-9764

HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication

published March 26, 2019

CVSS
—
EPSS
1%
Percentile
48.5
In the wild
Unconfirmed
What it is

HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00610 · 48.5th percentile
Published
2019-03-26T13:05Z
EPSS history
Timeline
  • 26 MAR 13:05Z
    HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication
    cvelistv5