CVE-2020-12757: Input Validation
HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.
Other sources
HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-12757?
The severity of CVE-2020-12757 is critical, with a CVSS score of 9.8.
How is HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 affected by CVE-2020-12757?
HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin is affected by CVE-2020-12757 due to incorrect access control.
What is the remedy for CVE-2020-12757?
The recommended remedy for CVE-2020-12757 is to update the package github.com/hashicorp/vault-plugin-secrets-gcp to version 0.6.2.
Where can I find more information about CVE-2020-12757?
You can find more information about CVE-2020-12757 on the NIST National Vulnerability Database (NVD) at https://nvd.nist.gov/vuln/detail/CVE-2020-12757.
What is the Common Weakness Enumeration (CWE) ID associated with CVE-2020-12757?
The Common Weakness Enumeration (CWE) ID associated with CVE-2020-12757 is CWE-20, which is for Improper Input Validation.