hashicorp Archives - CVE Vulnerability

CVE-2018-9057

Sun, 26 Feb 2023 06:51:42 +0000

aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.

The post CVE-2018-9057 appeared first on CVE Vulnerability.

CVE-2018-15869

Sun, 26 Feb 2023 06:46:48 +0000

An Amazon Web Services (AWS) developer who does not specify the –owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

The post CVE-2018-15869 appeared first on CVE Vulnerability.

CVE-2020-8567

Sun, 26 Feb 2023 06:43:26 +0000

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.

The post CVE-2020-8567 appeared first on CVE Vulnerability.

CVE-2020-7955

Sun, 26 Feb 2023 06:43:13 +0000

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.

The post CVE-2020-7955 appeared first on CVE Vulnerability.

CVE-2020-7219

Sun, 26 Feb 2023 06:42:59 +0000

HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3.

The post CVE-2020-7219 appeared first on CVE Vulnerability.

CVE-2020-7218

Sun, 26 Feb 2023 06:42:59 +0000

HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 0.10.3.

The post CVE-2020-7218 appeared first on CVE Vulnerability.

CVE-2020-29564

Sun, 26 Feb 2023 06:40:58 +0000

The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password.

The post CVE-2020-29564 appeared first on CVE Vulnerability.

CVE-2020-29529

Sun, 26 Feb 2023 06:40:58 +0000

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.

The post CVE-2020-29529 appeared first on CVE Vulnerability.

CVE-2020-28348

Sun, 26 Feb 2023 06:40:38 +0000

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.

The post CVE-2020-28348 appeared first on CVE Vulnerability.

CVE-2020-28053

Sun, 26 Feb 2023 06:40:34 +0000

HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.

The post CVE-2020-28053 appeared first on CVE Vulnerability.