Go modules package
github.com/hashicorp/vault
pkg:golang/github.com/hashicorp/vault
Vulnerabilities (55)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-7594 | — | >= 1.7.7, < 1.17.6 | 1.17.6 | Sep 26, 2024 | Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engin | ||
| CVE-2024-8365 | — | >= 1.17.3, < 1.17.5 | 1.17.5 | Sep 2, 2024 | Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token ac | ||
| CVE-2024-6468 | — | >= 1.10.0, < 1.15.12 | 1.15.12 | Jul 11, 2024 | Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxy_protocol_behavior, was set to deny_unauthorized. When receiving a request from a source IP address that was not listed in proxy_protocol_auth | ||
| CVE-2024-5798 | — | >= 1.17.0-rc1, < 1.17.0 | 1.17.0 | Jun 12, 2024 | Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed whe | ||
| CVE-2024-2660 | — | < 1.16.0 | 1.16.0 | Apr 4, 2024 | Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterpri | ||
| CVE-2024-2048 | — | >= 1.15.0, < 1.15.5 | 1.15.5 | Mar 4, 2024 | Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to | ||
| CVE-2024-0831 | — | >= 1.15.0, < 1.15.5 | 1.15.5 | Feb 1, 2024 | Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`. | ||
| CVE-2023-6337 | — | >= 1.15.0, < 1.15.4 | 1.15.4 | Dec 8, 2023 | HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the e | ||
| CVE-2023-5954 | — | < 1.13.10 | 1.13.10 | Nov 9, 2023 | HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10. | ||
| CVE-2023-5077 | — | < 1.13.0 | 1.13.0 | Sep 28, 2023 | The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0. | ||
| CVE-2023-4680 | — | >= 1.6.0, < 1.12.11 | 1.12.11 | Sep 14, 2023 | HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially d | ||
| CVE-2023-3462 | — | < 1.13.5 | 1.13.5 | Jul 31, 2023 | HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnera | ||
| CVE-2023-2121 | — | < 1.11.11 | 1.11.11 | Jun 9, 2023 | Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11. | ||
| CVE-2023-0620 | — | >= 0.8.0, < 1.11.9 | 1.11.9 | Mar 30, 2023 | HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed | ||
| CVE-2023-0665 | — | < 1.11.9 | 1.11.9 | Mar 30, 2023 | HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance | ||
| CVE-2023-25000 | — | < 1.11.9 | 1.11.9 | Mar 30, 2023 | HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the sea | ||
| CVE-2023-24999 | — | < 1.10.11 | 1.10.11 | Mar 10, 2023 | HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.1 | ||
| CVE-2022-41316 | — | >= 1.11.0, < 1.11.4 | 1.11.4 | Oct 12, 2022 | HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11. | ||
| CVE-2022-40186 | — | >= 1.11.0, < 1.11.3 | 1.11.3 | Sep 22, 2022 | An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an i | ||
| CVE-2022-30689 | — | >= 1.10.0, < 1.10.3 | 1.10.3 | May 17, 2022 | HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. F |
- CVE-2024-7594Sep 26, 2024affected >= 1.7.7, < 1.17.6fixed 1.17.6
Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engin
- CVE-2024-8365Sep 2, 2024affected >= 1.17.3, < 1.17.5fixed 1.17.5
Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token ac
- CVE-2024-6468Jul 11, 2024affected >= 1.10.0, < 1.15.12fixed 1.15.12
Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxy_protocol_behavior, was set to deny_unauthorized. When receiving a request from a source IP address that was not listed in proxy_protocol_auth
- CVE-2024-5798Jun 12, 2024affected >= 1.17.0-rc1, < 1.17.0fixed 1.17.0
Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed whe
- CVE-2024-2660Apr 4, 2024affected < 1.16.0fixed 1.16.0
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterpri
- CVE-2024-2048Mar 4, 2024affected >= 1.15.0, < 1.15.5fixed 1.15.5
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to
- CVE-2024-0831Feb 1, 2024affected >= 1.15.0, < 1.15.5fixed 1.15.5
Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`.
- CVE-2023-6337Dec 8, 2023affected >= 1.15.0, < 1.15.4fixed 1.15.4
HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the e
- CVE-2023-5954Nov 9, 2023affected < 1.13.10fixed 1.13.10
HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.
- CVE-2023-5077Sep 28, 2023affected < 1.13.0fixed 1.13.0
The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.
- CVE-2023-4680Sep 14, 2023affected >= 1.6.0, < 1.12.11fixed 1.12.11
HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially d
- CVE-2023-3462Jul 31, 2023affected < 1.13.5fixed 1.13.5
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnera
- CVE-2023-2121Jun 9, 2023affected < 1.11.11fixed 1.11.11
Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.
- CVE-2023-0620Mar 30, 2023affected >= 0.8.0, < 1.11.9fixed 1.11.9
HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed
- CVE-2023-0665Mar 30, 2023affected < 1.11.9fixed 1.11.9
HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance
- CVE-2023-25000Mar 30, 2023affected < 1.11.9fixed 1.11.9
HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the sea
- CVE-2023-24999Mar 10, 2023affected < 1.10.11fixed 1.10.11
HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.1
- CVE-2022-41316Oct 12, 2022affected >= 1.11.0, < 1.11.4fixed 1.11.4
HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.
- CVE-2022-40186Sep 22, 2022affected >= 1.11.0, < 1.11.3fixed 1.11.3
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an i
- CVE-2022-30689May 17, 2022affected >= 1.10.0, < 1.10.3fixed 1.10.3
HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. F
Page 2 of 3