CVE-2021-32923: High severity hashicorp vault vulnerability
HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this HashiCorp Vault vulnerability?
The vulnerability ID for this HashiCorp Vault vulnerability is CVE-2021-32923.
What is the severity of CVE-2021-32923?
The severity of CVE-2021-32923 is high with a score of 7.4.
Which versions of HashiCorp Vault are affected by CVE-2021-32923?
Versions 0.10.0 to 1.5.9 of HashiCorp Vault and HashiCorp Vault Enterprise, versions 1.6.0 to 1.6.5, and versions 1.7.0 to 1.7.2 are affected by CVE-2021-32923.
How can I fix CVE-2021-32923?
To fix CVE-2021-32923, update to the fixed versions of HashiCorp Vault: 1.5.9, 1.6.5, or 1.7.2.
Where can I find more information about CVE-2021-32923?
You can find more information about CVE-2021-32923 in the following references: 1. [HashiCorp Discuss](https://discuss.hashicorp.com/t/hcsec-2021-15-vault-renewed-nearly-expired-leases-with-incorrect-non-expiring-ttls/24603) 2. [Gentoo GLSA](https://security.gentoo.org/glsa/202207-01) 3. [HashiCorp Blog](https://www.hashicorp.com/blog/category/vault/)