CVE-2022-25243: Medium severity hashicorp vault vulnerability

Q: What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2022-25243.

Q: What is the severity of CVE-2022-25243?

The severity of CVE-2022-25243 is medium with a CVSS score of 6.5.

Q: Which versions of Vault and Vault Enterprise are affected by CVE-2022-25243?

Vault and Vault Enterprise versions 1.8.0 through 1.8.8 and 1.9.0 through 1.9.3 are affected by CVE-2022-25243.

Q: What is the impact of CVE-2022-25243?

CVE-2022-25243 allows the PKI secrets engine to issue wildcard certificates to authorized users for a specified domain, even if the allow_subdomains attribute is set to false.

Q: How can I fix CVE-2022-25243?

You can fix CVE-2022-25243 by upgrading to Vault Enterprise version 1.8.9 or 1.9.4.

Published Mar 7, 2022

Updated

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allowsubdomains is set to false. Fixed in Vault Enterprise 1.8.9 and 1.9.4.

Affected Software

4 affected components

HashiCorp Vault>=1.8.0<1.8.9

HashiCorp Vault>=1.9.0<1.9.4

Event History

Mar 7, 2022

CVE Published

via MITRE·09:45 PM

Data Sourced

via MITRE·09:45 PM

Description

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID for this vulnerability is CVE-2022-25243.

What is the severity of CVE-2022-25243?

The severity of CVE-2022-25243 is medium with a CVSS score of 6.5.

Which versions of Vault and Vault Enterprise are affected by CVE-2022-25243?