7.4

CVE-2019-9764: hashicorp consul Origin Validation Error

CVSS: 7.4v3.0HighModified
AliasesUBUNTU-CVE-2019-9764CGA-3f4h-49v9-fj84CGA-8cwq-gh3p-vxpf
Published 26-03-2019Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2019-9764 is a high (CVSS 7.4) Origin Validation Error vulnerability in hashicorp consul. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48.2% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
40/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.4/10
010
High · v3.0 (NVD)
EPSS score
0.61%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 0 · Related 6
CGA-4F73-PXCH-G7WVCGA-93GV-HV4C-83GXCGA-CP9W-MFRQ-958QCGA-F8GH-26VJ-59C8CGA-JJ23-WMWC-85R9CGA-PHWR-CQX8-JCPX

Timeline

  1. 26-03-2019
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

0.61%

Chance of exploitation in the next 30 days

Percentile

48%

Versus all other CVEs

30-day change

0.00 pp

From 0.61% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.61%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Consul

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard3 products
  • k3d< 5.6.0-r11
  • k3d-proxy< 5.6.0-r11
  • k3d-tools< 5.6.0-r11
Wolfi3 products
  • k3d< 5.6.0-r11
  • k3d-proxy< 5.6.0-r11
  • k3d-tools< 5.6.0-r11
Github.com/hashicorp1 product
  • consul< 1.4.4
Hashicorp1 product
Ubuntu1 product
  • consulAll versions (No fix recorded)

5 vendors · 9 products

References

7 links