Advisoriesby IbisVaultGHSA-32cj-5wx4-gq8p
HashiCorp Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims
Fix: upgrade to 1.15.9 or later (3 fixed versions below)
Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected.
This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/vault Go | >= 1.17.0-rc1, < 1.17.0 | 1.17.0 |
| >= 1.16.0-rc1, < 1.16.3 | 1.16.3 | |
| >= 0.11.0, < 1.15.9 | 1.15.9 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-285
- Also known as
- BIT-vault-2024-5798, CVE-2024-5798, GO-2024-2921
More Vault advisories
All Vault
Vault Community Edition privilege escalation vulnerabilityCVE-2024-9180fixed in 1.18.0 +1Vault Leaks Client Token and Token Accessor in Audit DevicesCVE-2024-8365fixed in 1.17.5Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional ConditionsCVE-2024-6468fixed in 1.15.12 +2HashiCorpVault does not correctly validate OCSP responsesCVE-2024-2660fixed in 1.16.0Incorrect TLS certificate auth method in VaultCVE-2024-2048fixed in 1.14.10 +1Hashicorp Vault may expose sensitive log informationCVE-2024-0831fixed in 1.15.5