CVE-2021-32923
First published: Thu Jun 03 2021(Updated: )
HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HashiCorp Vault | >=0.10.0<1.5.9 | |
| HashiCorp Vault | >=0.10.0<1.5.9 | |
| HashiCorp Vault | >=1.6.0<1.6.5 | |
| HashiCorp Vault | >=1.6.0<1.6.5 | |
| HashiCorp Vault | >=1.7.0<1.7.2 | |
| HashiCorp Vault | >=1.7.0<1.7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this HashiCorp Vault vulnerability?
The vulnerability ID for this HashiCorp Vault vulnerability is CVE-2021-32923.
What is the severity of CVE-2021-32923?
The severity of CVE-2021-32923 is high with a score of 7.4.
Which versions of HashiCorp Vault are affected by CVE-2021-32923?
Versions 0.10.0 to 1.5.9 of HashiCorp Vault and HashiCorp Vault Enterprise, versions 1.6.0 to 1.6.5, and versions 1.7.0 to 1.7.2 are affected by CVE-2021-32923.
How can I fix CVE-2021-32923?
To fix CVE-2021-32923, update to the fixed versions of HashiCorp Vault: 1.5.9, 1.6.5, or 1.7.2.
Where can I find more information about CVE-2021-32923?
You can find more information about CVE-2021-32923 in the following references: 1. [HashiCorp Discuss](https://discuss.hashicorp.com/t/hcsec-2021-15-vault-renewed-nearly-expired-leases-with-incorrect-non-expiring-ttls/24603) 2. [Gentoo GLSA](https://security.gentoo.org/glsa/202207-01) 3. [HashiCorp Blog](https://www.hashicorp.com/blog/category/vault/)
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- vendor/hashicorp
- canonical/hashicorp vault
- version/hashicorp vault/0.10.0
- version/hashicorp vault/1.6.0
- version/hashicorp vault/1.7.0