Latest hashicorp vault Vulnerabilities

● CVE-2024-0831
Vault May Expose Sensitive Information When Configuring An Audit Log Device
go/github.com/hashicorp/vault>=1.15.0<1.15.5
HashiCorp Vault>=1.15.0<1.15.5
HashiCorp Vault>=1.15.0<1.15.5
● CVE-2023-6337
Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests
go/github.com/hashicorp/vault>=1.12.0<1.13.12
go/github.com/hashicorp/vault>=1.14.0<1.14.8
go/github.com/hashicorp/vault>=1.15.0<1.15.4
<=1.12.0
<=1.12.0
>=1.13.0<1.13.12
and 5 more
● CVE-2023-5954
Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption
go/github.com/hashicorp/vault>=1.15.0<1.15.2
go/github.com/hashicorp/vault>=1.14.0<1.14.6
go/github.com/hashicorp/vault<1.13.10
HashiCorp Vault>=1.13.7<1.13.10
HashiCorp Vault>=1.13.7<1.13.10
HashiCorp Vault>=1.14.3<1.14.6
and 9 more
● CVE-2023-3775
A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potent...
HashiCorp Vault>=0.11.0<1.13.8
HashiCorp Vault>=1.14.0<1.14.4
● CVE-2023-5077
The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.
HashiCorp Vault>=0.10.0<1.13.0
HashiCorp Vault>=0.10.0<1.13.0
>=0.10.0<1.13.0
>=0.10.0<1.13.0
go/github.com/hashicorp/vault<1.13.0
redhat/vault<1.13.0
● CVE-2023-4680
HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an...
go/github.com/hashicorp/vault>=1.14.0<1.14.3
go/github.com/hashicorp/vault>=1.13.0<1.13.7
go/github.com/hashicorp/vault>=1.6.0<1.12.11
HashiCorp Vault>=1.6.0<1.12.11
HashiCorp Vault>=1.6.0<1.12.11
HashiCorp Vault>=1.13.0<1.13.7
and 3 more
● CVE-2023-3462
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the respo...
HashiCorp Vault>=1.13.0<1.13.5
HashiCorp Vault>=1.13.0<1.13.5
HashiCorp Vault=1.14.0
HashiCorp Vault=1.14.0
redhat/vault<1.14.1
redhat/vault<1.13.5
● CVE-2023-3774
An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1, 1.13.5, and 1.12.9.
HashiCorp Vault=1.12.8
HashiCorp Vault=1.13.4
HashiCorp Vault=1.14.0
● CVE-2023-2121
Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13...
HashiCorp Vault<1.11.11
HashiCorp Vault<1.11.11
HashiCorp Vault>=1.12.0<1.12.7
HashiCorp Vault>=1.12.0<1.12.7
HashiCorp Vault>=1.13.0<1.13.3
HashiCorp Vault>=1.13.0<1.13.3
and 7 more
● CVE-2023-0665
HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did...
go/github.com/hashicorp/vault>=1.13.0<1.13.1
go/github.com/hashicorp/vault>=1.12.0<1.12.5
go/github.com/hashicorp/vault<1.11.9
HashiCorp Vault<1.11.9
HashiCorp Vault<1.11.9
HashiCorp Vault>=1.12.0<1.12.5
and 6 more
● CVE-2023-0620
HashiCorp Vault and Vault Enterprise versions 0.8.0 until 1.13.1 are vulnerable to an SQL injection attack when using the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plu...
HashiCorp Vault<1.11.9
HashiCorp Vault<1.11.9
HashiCorp Vault>=1.12.0<1.12.5
HashiCorp Vault>=1.12.0<1.12.5
HashiCorp Vault>=1.13.0<1.13.1
HashiCorp Vault>=1.13.0<1.13.1
and 3 more
● CVE-2023-25000
HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large n...
HashiCorp Vault<1.11.9
HashiCorp Vault<1.11.9
HashiCorp Vault>=1.12.0<1.12.5
HashiCorp Vault>=1.12.0<1.12.5
HashiCorp Vault>=1.13.0<1.13.1
HashiCorp Vault>=1.13.0<1.13.1
and 3 more
● CVE-2023-24999
HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ...
HashiCorp Vault<1.10.11
HashiCorp Vault<1.10.11
HashiCorp Vault>=1.11.0<1.11.8
HashiCorp Vault>=1.11.0<1.11.8
HashiCorp Vault>=1.12.0<1.12.4
HashiCorp Vault>=1.12.0<1.12.4
● CVE-2022-41316
HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list...
HashiCorp Vault<1.9.10
HashiCorp Vault<1.9.10
HashiCorp Vault>=1.10.0<1.10.7
HashiCorp Vault>=1.10.0<1.10.7
HashiCorp Vault>=1.11.0<1.11.4
HashiCorp Vault>=1.11.0<1.11.4
● CVE-2022-40186
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with...
HashiCorp Vault>=1.8.0<1.9.9
HashiCorp Vault>=1.8.0<1.9.9
HashiCorp Vault>=1.10.0<1.10.6
HashiCorp Vault>=1.10.0<1.10.6
HashiCorp Vault>=1.11.0<1.11.3
HashiCorp Vault>=1.11.0<1.11.3
● CVE-2022-36129
HashiCorp Vault Enterprise 1.7.0 through 1.9.7, 1.10.4, and 1.11.0 clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node ...
HashiCorp Vault>=1.7.0<=1.9.7
HashiCorp Vault>=1.10.0<=1.10.4
HashiCorp Vault=1.11.0
HashiCorp Vault=1.11.0
● CVE-2022-30689
HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault ...
HashiCorp Vault>=1.10.0<1.10.3
HashiCorp Vault>=1.10.0<1.10.3
● CVE-2022-25243
"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even i...
HashiCorp Vault>=1.8.0<1.8.9
HashiCorp Vault>=1.8.0<1.8.9
HashiCorp Vault>=1.9.0<1.9.4
HashiCorp Vault>=1.9.0<1.9.4
● CVE-2022-25244
Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with `read` permissions o...
HashiCorp Vault>=1.7.0<1.7.10
HashiCorp Vault>=1.8.0<1.8.9
HashiCorp Vault>=1.9.0<1.9.4
● CVE-2021-45042
In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions to...
HashiCorp Vault>=1.4.0<1.7.7
HashiCorp Vault>=1.4.0<1.7.7
HashiCorp Vault>=1.8.0<1.8.6
HashiCorp Vault>=1.8.0<1.8.6
HashiCorp Vault=1.9.0
HashiCorp Vault=1.9.0
● CVE-2021-43998
HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and m...
HashiCorp Vault>=0.11.0<=1.7.5
HashiCorp Vault>=0.11.0<=1.7.5
HashiCorp Vault=1.8.4
HashiCorp Vault=1.8.4
redhat/Vault<1.7.6
redhat/Vault<1.8.5
and 1 more
● CVE-2021-42135
HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more ...
HashiCorp Vault>=1.8.0<=1.8.4
HashiCorp Vault>=1.8.0<=1.8.4
● CVE-2021-41802
HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies...
HashiCorp Vault<1.7.5
HashiCorp Vault<1.7.5
HashiCorp Vault>=1.8.0<1.8.4
HashiCorp Vault>=1.8.0<1.8.4
● CVE-2021-27668
HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.
HashiCorp Vault>=0.9.2<1.6.3
● CVE-2021-38553
HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in ...
HashiCorp Vault>=1.4.0<1.8.0
HashiCorp Vault>=1.4.0<1.8.0
● CVE-2021-38554
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
HashiCorp Vault<1.8.0
HashiCorp Vault<1.8.0
● CVE-2021-32923
HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be in...
HashiCorp Vault>=0.10.0<1.5.9
HashiCorp Vault>=0.10.0<1.5.9
HashiCorp Vault>=1.6.0<1.6.5
HashiCorp Vault>=1.6.0<1.6.5
HashiCorp Vault>=1.7.0<1.7.2
HashiCorp Vault>=1.7.0<1.7.2
● CVE-2021-29653
HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8, 1.6.4, and 1.7.1.
HashiCorp Vault>=1.5.1<1.5.8
HashiCorp Vault>=1.5.1<1.5.8
HashiCorp Vault>=1.6.0<1.6.4
HashiCorp Vault>=1.6.0<1.6.4
HashiCorp Vault>=1.7.0<1.7.1
HashiCorp Vault>=1.7.0<1.7.1
● CVE-2021-27400
HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4...
HashiCorp Vault<1.6.4
HashiCorp Vault<1.6.4
HashiCorp Vault>=1.7.0<1.7.1
HashiCorp Vault>=1.7.0<1.7.1
● CVE-2021-3024
HashiCorp Vault<1.5.7
HashiCorp Vault<1.5.7
HashiCorp Vault>=1.6.0<1.6.2
HashiCorp Vault>=1.6.0<1.6.2
● CVE-2021-3282
HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.
HashiCorp Vault=1.6.0
HashiCorp Vault=1.6.1
go/github.com/hashicorp/vault>=1.6.0<1.6.2
● CVE-2020-25594
HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.
HashiCorp Vault<1.5.7
HashiCorp Vault<1.5.7
HashiCorp Vault>=1.6.0<1.6.2
HashiCorp Vault>=1.6.0<1.6.2
● CVE-2020-35177
HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.
HashiCorp Vault>=1.5.0<1.5.6
HashiCorp Vault>=1.5.0<1.5.6
HashiCorp Vault>=1.6.0<1.6.1
HashiCorp Vault>=1.6.0<1.6.1
go/github.com/hashicorp/vault>=1.6.0<1.6.1
go/github.com/hashicorp/vault>=1.5.0<1.5.6
● CVE-2020-35453
HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. Fixed in 1.5.6 and 1.6.1.
HashiCorp Vault>=1.5.0<1.5.6
HashiCorp Vault>=1.5.0<1.5.6
HashiCorp Vault>=1.6.0<1.6.1
HashiCorp Vault>=1.6.0<1.6.1
● CVE-2020-35192
The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed by affected versions of the docker image may allow a remote at...
HashiCorp Vault>=0.6.0<0.11.6
● CVE-2020-25816
HashiCorp Vault and Vault Enterprise 1.0 before 1.5.4 have Incorrect Access Control.
HashiCorp Vault>=1.0.0<1.4.7
HashiCorp Vault>=1.0.0<1.4.7
HashiCorp Vault>=1.5.0<1.5.4
HashiCorp Vault>=1.5.0<1.5.4
go/github.com/hashicorp/vault>=1.0<1.5.4
● CVE-2020-16251
A vulnerability was identified in Vault and Vault Enterprise (“Vault”) such that, with the GCP Auth Method configured and under certain circumstances, the values relied upon by Vault to validate Googl...
HashiCorp Vault>=0.8.3<1.2.5
HashiCorp Vault>=1.3.0<1.3.8
HashiCorp Vault>=1.4.0<1.4.4
HashiCorp Vault>=1.5.0<1.5.1
HashiCorp Vault>=0.8.3<1.2.5
HashiCorp Vault>=1.3.0<1.3.8
and 18 more
● CVE-2020-16250
A flaw was found in Vault and Vault Enterprise (“Vault”). In the affected versions of Vault, with the AWS Auth Method configured and under certain circumstances, the values relied upon by Vault to val...
go/github.com/hashicorp/vault>=1.4.0<1.4.4
go/github.com/hashicorp/vault>=1.3.0<1.3.8
go/github.com/hashicorp/vault>=0.8.1<1.2.5
go/github.com/hashicorp/vault>=1.5.0<1.5.1
HashiCorp Vault>=0.7.1<1.2.5
HashiCorp Vault>=0.7.1<1.2.5
and 6 more
● CVE-2020-13223
HashiCorp Vault and Vault Enterprise before 1.3.6, and 1.4.2 before 1.4.2, insert Sensitive Information into a Log File. The vulnerability is affecting `github.com/hashicorp/vault/command` Go package.
go/github.com/hashicorp/vault>=1.4.0<1.4.2
go/github.com/hashicorp/vault>=1.3.0<1.3.6
HashiCorp Vault<1.3.6
HashiCorp Vault>=1.4.0<1.4.2
HashiCorp Vault<1.3.6
HashiCorp Vault>=1.4.0<1.4.2
● CVE-2020-12757
HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control.
go/github.com/hashicorp/vault-plugin-secrets-gcp<0.6.2
HashiCorp Vault>=1.4.0<1.4.2
HashiCorp Vault>=1.4.0<1.4.2
● CVE-2020-10660
HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions ...
HashiCorp Vault>=0.9.0<=1.3.3
HashiCorp Vault>=0.9.0<=1.3.3
go/github.com/hashicorp/vault/vault>=0.9.0<1.3.4
● CVE-2020-10661
HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3....
HashiCorp Vault>=0.11.0<=1.3.3
HashiCorp Vault>=0.11.0<=1.3.3
go/github.com/hashicorp/vault/vault>=0.11.0<1.3.4
● CVE-2020-7220
HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.
HashiCorp Vault>=0.11.0<1.3.2
● CVE-2018-19786
HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being repo...
HashiCorp Vault<1.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203