CVE-2021-27668: Medium severity HashiCorp Vault vulnerability
HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/vaultto a version that resolves this vulnerability.Fixed in 1.5.8-r0 - Upgrade
Upgrade
alpine/vaultto a version that resolves this vulnerability.Fixed in 1.7.1-r0 - Upgrade
Upgrade
HashiCorp Vault Enterpriseto a version that resolves this vulnerability.Fixed in 1.6.3
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2021-27668.
What is the severity of CVE-2021-27668?
The severity of CVE-2021-27668 is medium with a severity value of 5.3.
What software versions are affected by CVE-2021-27668?
HashiCorp Vault Enterprise versions 0.9.2 through 1.6.2 are affected by CVE-2021-27668.
How can I fix CVE-2021-27668?
CVE-2021-27668 can be fixed by upgrading to version 1.6.3 of HashiCorp Vault Enterprise.
Are there any references for CVE-2021-27668?
Yes, you can find references for CVE-2021-27668 at the following links: [Reference 1](https://discuss.hashicorp.com/t/hcsec-2021-05-vault-enterprise-s-dr-secondaries-exposed-license-metadata-without-authentication/21427) and [Reference 2](https://security.gentoo.org/glsa/202207-01).