Hashicorp

Vault

72 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.5

CVE-2021-41802

  • EPSS 0.24%
  • Veröffentlicht 08.10.2021 17:15:07
  • Zuletzt bearbeitet 21.11.2024 06:26:47

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and V...

5.3

CVE-2021-27668

  • EPSS 0.33%
  • Veröffentlicht 31.08.2021 18:15:07
  • Zuletzt bearbeitet 21.11.2024 05:58:24

HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.

4.4

CVE-2021-38553

  • EPSS 0.03%
  • Veröffentlicht 13.08.2021 16:15:08
  • Zuletzt bearbeitet 21.11.2024 06:17:25

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.

5.3

CVE-2021-38554

  • EPSS 0.29%
  • Veröffentlicht 13.08.2021 16:15:08
  • Zuletzt bearbeitet 21.11.2024 06:17:25

HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.

7.4

CVE-2021-32923

  • EPSS 0.22%
  • Veröffentlicht 03.06.2021 11:15:08
  • Zuletzt bearbeitet 21.11.2024 06:07:56

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequen...

7.5

CVE-2021-29653

  • EPSS 0.1%
  • Veröffentlicht 22.04.2021 17:15:07
  • Zuletzt bearbeitet 21.11.2024 06:01:34

HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8, 1.6.4, and 1.7.1.

7.5

CVE-2021-27400

  • EPSS 0.19%
  • Veröffentlicht 22.04.2021 17:15:07
  • Zuletzt bearbeitet 21.11.2024 05:57:55

HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1

7.5

CVE-2021-3282

  • EPSS 0.32%
  • Veröffentlicht 01.02.2021 16:15:13
  • Zuletzt bearbeitet 21.11.2024 06:21:12

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

5.3

CVE-2021-3024

  • EPSS 0.45%
  • Veröffentlicht 01.02.2021 16:15:13
  • Zuletzt bearbeitet 21.11.2024 06:20:46

HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.

5.3

CVE-2020-25594

  • EPSS 0.45%
  • Veröffentlicht 01.02.2021 16:15:12
  • Zuletzt bearbeitet 21.11.2024 05:18:11

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.