Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
49 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.
Recommended action: Upgrade to 1.3.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.
Recommended action: Upgrade to 1.3.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash. Fixed in Vault 1.15.4, 1.14.8, 1.13.12.
Recommended action: Upgrade to 1.15.4, 1.14.8 or 1.13.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
Recommended action: Upgrade to 1.15.2, 1.14.6 or 1.13.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.
Recommended action: Upgrade to 1.13.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.
Recommended action: Upgrade to 1.14.3, 1.13.7 or 1.12.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/vault < 1.13.5; >= 1.14.0, <= 1.14.0
Fixed in
1.13.51.14.1· Vendor fix available
Issue
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.
Recommended action: Upgrade to 1.14.1 or 1.13.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When using the Vault and Vault Enterprise (Vault) approle auth method, any authenticated user with access to the /auth/approle/role/:rolename/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-24999, has been fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.
Recommended action: Upgrade to 1.12.4, 1.11.8 or 1.10.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.
Recommended action: Upgrade to 1.11.4, 1.10.7 or 1.9.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.
Recommended action: Upgrade to 1.13.3, 1.12.7 or 1.11.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault and Vault Enterprise versions 0.8.0 until 1.13.1 are vulnerable to an SQL injection attack when using the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin, certain parameters are required to establish a connection (schema, database, and table) are not sanitized when passed to the user-provided MSSQL database. A privileged attacker with the ability to write arbitrary data to Vault's configuration may modify these parameters to execute a malicious SQL command when the Vault configuration is applied. This issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9.
Recommended action: Upgrade to 1.13.1, 1.12.5 or 1.11.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
Recommended action: Upgrade to 1.13.1, 1.12.5 or 1.11.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
Recommended action: Upgrade to 1.13.1, 1.12.5 or 1.11.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checking the proper alias assigned to an entity. This may allow for unintended access to key/value paths using that metadata in Vault.
Recommended action: Upgrade to 1.11.3, 1.10.6 or 1.9.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/vault >= 1.0.0-beta1, < 1.5.4
Fixed in
1.5.4· Vendor fix available
Issue
HashiCorp Vault and Vault Enterprise 1.0 before 1.5.4 have Incorrect Access Control.
Recommended action: Upgrade to 1.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3.
Recommended action: Upgrade to 1.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/vault >= 1.8.0, < 1.8.5; >= 0.11.0, < 1.7.6
Fixed in
1.8.51.7.6· Vendor fix available
Issue
HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.
Recommended action: Upgrade to 1.8.5 or 1.7.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/vault < 1.7.5; >= 1.8.0, < 1.8.4
Fixed in
1.7.51.8.4· Vendor fix available
Issue
HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.
Recommended action: Upgrade to 1.8.4 or 1.7.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.
Recommended action: Upgrade to 1.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/vault < 1.6.6; >= 1.7.0, < 1.7.4
Fixed in
1.6.61.7.4· Vendor fix available
Issue
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
Recommended action: Upgrade to 1.7.4 or 1.6.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..
Recommended action: Upgrade to 1.5.1, 1.4.4, 1.3.8 or 1.2.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.
Recommended action: Upgrade to 1.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
Recommended action: Upgrade to 1.7.2, 1.6.5 or 1.5.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hashicorp/vault >= 1.3.0, < 1.3.6; >= 1.4.0, < 1.4.2
Fixed in
1.4.21.3.6· Vendor fix available
Issue
HashiCorp Vault and Vault Enterprise before 1.3.6, and 1.4.2 before 1.4.2, insert Sensitive Information into a Log File. The vulnerability is affecting github.com/hashicorp/vault/command Go package.
Recommended action: Upgrade to 1.4.2 or 1.3.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.