vault Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/vault/ Sun, 26 Feb 2023 06:39:45 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png vault Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/vault/ 32 32 CVE-2020-25594 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-25594/ Sun, 26 Feb 2023 06:39:45 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-25594/ HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.

The post CVE-2020-25594 appeared first on CVE Vulnerability.

]]> HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.

The post CVE-2020-25594 appeared first on CVE Vulnerability.

]]> CVE-2021-45042 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-45042/ Thu, 23 Feb 2023 14:12:49 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-45042/ In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions to a kv secrets engine) to cause a panic and denial of service of the storage backend. The earliest affected version is 1.4.0.

The post CVE-2021-45042 appeared first on CVE Vulnerability.

]]> In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions to a kv secrets engine) to cause a panic and denial of service of the storage backend. The earliest affected version is 1.4.0.

The post CVE-2021-45042 appeared first on CVE Vulnerability.

]]> CVE-2021-43998 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-43998/ Thu, 23 Feb 2023 14:12:36 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-43998/ HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.

The post CVE-2021-43998 appeared first on CVE Vulnerability.

]]> HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.

The post CVE-2021-43998 appeared first on CVE Vulnerability.

]]> CVE-2021-41802 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-41802/ Thu, 23 Feb 2023 14:12:06 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-41802/ HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.

The post CVE-2021-41802 appeared first on CVE Vulnerability.

]]> HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.

The post CVE-2021-41802 appeared first on CVE Vulnerability.

]]> CVE-2021-38553 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-38553/ Thu, 23 Feb 2023 14:11:15 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-38553/ HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.

The post CVE-2021-38553 appeared first on CVE Vulnerability.

]]> HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.

The post CVE-2021-38553 appeared first on CVE Vulnerability.

]]> CVE-2021-38554 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-38554/ Thu, 23 Feb 2023 14:11:15 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-38554/ HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.

The post CVE-2021-38554 appeared first on CVE Vulnerability.

]]> HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.

The post CVE-2021-38554 appeared first on CVE Vulnerability.

]]> CVE-2021-32923 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-32923/ Thu, 23 Feb 2023 14:09:53 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-32923/ HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.

The post CVE-2021-32923 appeared first on CVE Vulnerability.

]]> HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.

The post CVE-2021-32923 appeared first on CVE Vulnerability.

]]> CVE-2021-3282 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-3282/ Thu, 23 Feb 2023 14:09:52 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-3282/ HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

The post CVE-2021-3282 appeared first on CVE Vulnerability.

]]> HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

The post CVE-2021-3282 appeared first on CVE Vulnerability.

]]> CVE-2021-3024 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-3024/ Thu, 23 Feb 2023 14:09:13 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-3024/ HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.

The post CVE-2021-3024 appeared first on CVE Vulnerability.

]]> HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.

The post CVE-2021-3024 appeared first on CVE Vulnerability.

]]> CVE-2021-27668 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-27668/ Thu, 23 Feb 2023 14:08:38 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-27668/ HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.

The post CVE-2021-27668 appeared first on CVE Vulnerability.

]]> HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.

The post CVE-2021-27668 appeared first on CVE Vulnerability.

]]>