Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

GitHub Actions package

hashicorp/vault-action

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5GitHub ActionsPublished

    Vault GitHub Action did not correctly mask multi-line secrets in output

    CVE-2021-32074 · GHSA-4mgv-m5cm-f9h7

    Affected
    • GitHub Actions hashicorp/vault-action < 2.2.0
    Fixed in
    2.2.0· Vendor fix available
    Issue
    HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking. The vault-action implementation did not correctly handle the marking of multi-line variables. As a result, multi-line secrets were not correctly masked in vault-action output. Remediation: Customers using vault-action should evaluate the risk associated with this issue, and consider upgrading to vault-action 2.2.0 or newer. Please refer to https://github.com/marketplace/actions/hashicorp-vault for more information.

    Recommended action: Upgrade to 2.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →