Missing subresource integrity check In github.com/hashicorp/consul
Description
HashiCorp Consul vulnerable to Origin Validation Error
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 1.4.4 |
Aliases
1. 2. 3. 4.
References
1. 2.