REDHAT-BUG-2459105: High severity HashiCorp Vault Community Edition vulnerability
An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2459105?
The severity of REDHAT-BUG-2459105 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2459105?
To fix REDHAT-BUG-2459105, users should review and restrict policy permissions related to kvv2 paths.
What consequence does REDHAT-BUG-2459105 pose for authenticated users?
Authenticated users may be able to delete secrets they are not authorized to access, leading to potential denial-of-service.
Does REDHAT-BUG-2459105 allow secret deletion across namespaces?
No, REDHAT-BUG-2459105 does not permit deletion of secrets across different namespaces.
Which software versions are affected by REDHAT-BUG-2459105?
REDHAT-BUG-2459105 affects HashiCorp Vault Community Edition, HashiCorp Vault Enterprise, and HashiCorp Vault.