CVE-2020-25816: Critical severity HashiCorp Vault vulnerability
HashiCorp Vault and Vault Enterprise 1.0 before 1.5.4 have Incorrect Access Control.
Other sources
HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/hashicorp/vaultto a version that resolves this vulnerability.Fixed in 1.5.4 - Upgrade
Upgrade
alpine/vaultto a version that resolves this vulnerability.Fixed in 1.4.7-r0 - Upgrade
Upgrade
alpine/vaultto a version that resolves this vulnerability.Fixed in 1.5.4-r0 - Upgrade
Upgrade
HashiCorp Vault and Vault Enterpriseto a version that resolves this vulnerability.Fixed in 1.4.7 - Upgrade
Upgrade
HashiCorp Vault and Vault Enterpriseto a version that resolves this vulnerability.Fixed in 1.5.4
Event History
Frequently Asked Questions
What is the vulnerability ID of this HashiCorp Vault vulnerability?
The vulnerability ID is CVE-2020-25816.
What versions of HashiCorp Vault are affected by this vulnerability?
HashiCorp Vault versions 1.0 and newer are affected.
How can I fix the vulnerability in HashiCorp Vault?
The vulnerability is fixed in versions 1.4.7 and 1.5.4 of HashiCorp Vault.
What is the severity of CVE-2020-25816?
The severity of CVE-2020-25816 is medium with a CVSS score of 6.8.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability in the HashiCorp Vault Changelog and the HashiCorp blog.