CVE-2020-16251: High severity HashiCorp Vault vulnerability
A vulnerability was identified in Vault and Vault Enterprise (“Vault”) such that, with the GCP Auth Method configured and under certain circumstances, the values relied upon by Vault to validate Google Compute Engine (GCE) VMs may be manipulated and authentication bypassed.
https://www.hashicorp.com/blog/category/vault/ https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151 http://packetstormsecurity.com/files/159479/Hashicorp-Vault-GCP-IAM-Integration-Authentication-Bypass.html
Other sources
HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/vaultto a version that resolves this vulnerability.Fixed in 1.2.5 - Upgrade
Upgrade
redhat/vaultto a version that resolves this vulnerability.Fixed in 1.3.8 - Upgrade
Upgrade
redhat/vaultto a version that resolves this vulnerability.Fixed in 1.4.4 - Upgrade
Upgrade
redhat/vaultto a version that resolves this vulnerability.Fixed in 1.5.1 - Upgrade
Upgrade
go/github.com/hashicorp/vaultto a version that resolves this vulnerability.Fixed in 1.5.1 - Upgrade
Upgrade
go/github.com/hashicorp/vaultto a version that resolves this vulnerability.Fixed in 1.4.4 - Upgrade
Upgrade
go/github.com/hashicorp/vaultto a version that resolves this vulnerability.Fixed in 1.3.8 - Upgrade
Upgrade
go/github.com/hashicorp/vaultto a version that resolves this vulnerability.Fixed in 1.2.5 - Upgrade
Upgrade
alpine/vaultto a version that resolves this vulnerability.Fixed in 1.4.7-r0 - Upgrade
Upgrade
alpine/vaultto a version that resolves this vulnerability.Fixed in 1.5.4-r0 - Upgrade
Upgrade
HashiCorp Vaultto a version that resolves this vulnerability.Fixed in 1.2.5 - Upgrade
Upgrade
HashiCorp Vaultto a version that resolves this vulnerability.Fixed in 1.3.8 - Upgrade
Upgrade
HashiCorp Vaultto a version that resolves this vulnerability.Fixed in 1.4.4 - Upgrade
Upgrade
HashiCorp Vaultto a version that resolves this vulnerability.Fixed in 1.5.1
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
CVE-2020-16251.
What is the affected software?
HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method.
What is the severity of CVE-2020-16251?
The severity of CVE-2020-16251 is high, with a CVSS score of 8.2.
How can I fix CVE-2020-16251?
The vulnerability has been fixed in versions 1.2.5, 1.3.8, 1.4.4, and 1.5.1 of HashiCorp Vault and Vault Enterprise.
Where can I find more information about CVE-2020-16251?
You can find more information about CVE-2020-16251 on the following references: http://packetstormsecurity.com/files/159479/Hashicorp-Vault-GCP-IAM-Integration-Authentication-Bypass.html, https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151, and https://www.hashicorp.com/blog/category/vault/.