HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the
    verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that
    do not require a software upgrade. (CVE-2018-19653)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the     verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that     do not require a software upgrade. (CVE-2018-19653)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the telegraf package has been released.

An update of the kapacitor package has been released.

An update of the consul package has been released.

ID	Name	Product	Family	Severity
433457	SCA: security update for github.com/hashicorp/consul (GHSA-4qvx-qq5w-695p)	Tenable Cloud Security	SCA Checks	medium
433457	SCA: security update for github.com/hashicorp/consul (GHSA-4qvx-qq5w-695p)	Tenable Self-Hosted Container Security	SCA Checks	medium
250847	Linux Distros Unpatched Vulnerability : CVE-2018-19653	Nessus	Misc.	medium
204388	Photon OS 5.0: Telegraf PHSA-2023-5.0-0041	Nessus	PhotonOS Local Security Checks	high
204224	Photon OS 5.0: Kapacitor PHSA-2023-5.0-0045	Nessus	PhotonOS Local Security Checks	critical
202828	Photon OS 3.0: Consul PHSA-2019-3.0-0017	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2018-19653

medium

Tenable Plugins

medium

medium

medium

high

critical

medium