CVE-2021-38553: Medium severity HashiCorp Vault vulnerability
HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HashiCorp Vault and Vault Enterpriseto a version that resolves this vulnerability.Fixed in 1.8.0
Event History
Frequently Asked Questions
What is CVE-2021-38553?
CVE-2021-38553 is a vulnerability in HashiCorp Vault and Vault Enterprise versions 1.4.0 through 1.7.3 that initialized an underlying database file with excessively broad filesystem permissions.
How does CVE-2021-38553 affect HashiCorp Vault?
CVE-2021-38553 affects HashiCorp Vault versions 1.4.0 through 1.7.3 by initializing the integrated storage feature with excessively broad filesystem permissions.
What is the severity of CVE-2021-38553?
CVE-2021-38553 has a severity rating of medium (4.4).
How can I fix CVE-2021-38553?
To fix CVE-2021-38553, it is recommended to upgrade to HashiCorp Vault and Vault Enterprise version 1.8.0 or later.
Where can I find more information about CVE-2021-38553?
You can find more information about CVE-2021-38553 at the following references: [Link 1](https://discuss.hashicorp.com/t/hcsec-2021-20-vault-s-integrated-storage-backend-database-file-may-have-excessively-broad-permissions/28168) and [Link 2](https://security.gentoo.org/glsa/202207-01).