CVE-2024-8365: Vault Leaks AppRole Client Tokens And Accessor in Audit Log
Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8365?
CVE-2024-8365 is considered a high-severity vulnerability due to the exposure of sensitive client tokens and token accessors.
How can I fix CVE-2024-8365?
To fix CVE-2024-8365, upgrade to Vault version 1.17.6 or later, ensuring sensitive headers are properly HMAC'd.
What are the affected versions of Vault for CVE-2024-8365?
CVE-2024-8365 affects HashiCorp Vault versions from 1.17.0 to 1.17.5 for both Community and Enterprise editions.
What is the impact of CVE-2024-8365 on audit devices?
CVE-2024-8365 impacts the audit devices by leaking the plaintext values of client tokens and accessors, compromising security.
Who is affected by CVE-2024-8365?
Organizations using HashiCorp Vault versions specified in CVE-2024-8365 are at risk, particularly those relying on the audit logging feature.