CVE-2024-8365: Vault Leaks AppRole Client Tokens And Accessor in Audit Log
First published: Mon Sep 02 2024(Updated: )
Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9.
Credit: security@hashicorp.com security@hashicorp.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/hashicorp/vault | >=1.17.3<1.17.5 | 1.17.5 |
| HashiCorp Vault | <1.16.9 | |
| HashiCorp Vault | <1.17.5 | |
| HashiCorp Vault | >=1.17.0<1.17.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://discuss.hashicorp.com/t/hcsec-2024-18-vault-leaks-client-token-and-token-accessor-in-audit-devices/
- https://nvd.nist.gov/vuln/detail/CVE-2024-8365
- https://discuss.hashicorp.com/t/hcsec-2024-18-vault-leaks-client-token-and-token-accessor-in-audit-devices
- https://github.com/advisories/GHSA-jjxf-26c9-77gm (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-8365?
CVE-2024-8365 is considered a high-severity vulnerability due to the exposure of sensitive client tokens and token accessors.
How can I fix CVE-2024-8365?
To fix CVE-2024-8365, upgrade to Vault version 1.17.6 or later, ensuring sensitive headers are properly HMAC'd.
What are the affected versions of Vault for CVE-2024-8365?
CVE-2024-8365 affects HashiCorp Vault versions from 1.17.0 to 1.17.5 for both Community and Enterprise editions.
What is the impact of CVE-2024-8365 on audit devices?
CVE-2024-8365 impacts the audit devices by leaking the plaintext values of client tokens and accessors, compromising security.
Who is affected by CVE-2024-8365?
Organizations using HashiCorp Vault versions specified in CVE-2024-8365 are at risk, particularly those relying on the audit logging feature.
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/description
- agent/author
- agent/references
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/severity
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-jjxf-26c9-77gm
- alias/CVE-2024-8365
- agent/last-modified-date
- collector/nvd-cve
- agent/event
- collector/github-advisory
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/trending
- agent/tags
- agent/source
- vendor/hashicorp
- canonical/hashicorp vault
- version/hashicorp vault/1.17.0
- package-manager/go