AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

VaultGHSA-23fq-q7hc-993r

HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0

Vault

CVE-2021-38553 · Published Aug 30, 2021 · updated Aug 21, 2024

Critical9.8
Fix: upgrade to 1.8.0 or later
GitHub advisory

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/vault
Go
>= 1.4.0, < 1.8.01.8.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-281
Also known as
BIT-vault-2021-38553, CVE-2021-38553, GO-2022-0620

More Vault advisories

All Vault
High 8.1Oct 12, 2021Incorrect Privilege Assignment in HashiCorp VaultCVE-2021-42135no fix yetLow 2.9Oct 12, 2021Hashicorp Vault Privilege Escalation VulnerabilityCVE-2021-41802fixed in 1.7.5 +1Medium 5.3Aug 30, 2021Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp VaultCVE-2021-38554fixed in 1.6.6 +1High 8.2Aug 2, 2021Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp VaultCVE-2020-16250fixed in 1.2.5 +3High 7.5Jul 28, 2021Improper Resource Shutdown or Release in HashiCorp VaultCVE-2020-7220fixed in 1.3.2High 7.4Jun 8, 2021Invalid session token expirationCVE-2021-32923fixed in 1.5.9 +2