CVE-2021-45042: Medium severity hashicorp vault vulnerability
In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions to a kv secrets engine) to cause a panic and denial of service of the storage backend. The earliest affected version is 1.4.0.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-45042?
CVE-2021-45042 is a vulnerability in HashiCorp Vault and Vault Enterprise before versions 1.7.7, 1.8.6, and 1.9.1.
How does CVE-2021-45042 impact HashiCorp Vault?
CVE-2021-45042 allows an authenticated user with write permissions to a kv secrets engine to cause a panic and denial of service of the storage backend.
What is the severity of CVE-2021-45042?
The severity of CVE-2021-45042 is medium with a CVSS score of 4.9.
Which versions of HashiCorp Vault are affected?
HashiCorp Vault and Vault Enterprise versions before 1.7.7, 1.8.6, and 1.9.1 are affected.
How can I fix CVE-2021-45042?
To fix CVE-2021-45042, upgrade to HashiCorp Vault versions 1.7.7, 1.8.6, or 1.9.1.