AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

VaultGHSA-362v-wg5p-64w2

Incorrect Privilege Assignment in HashiCorp Vault

Vault

CVE-2021-42135 · Published Oct 12, 2021 · updated Aug 21, 2024

High8.1
No fix yet
GitHub advisory

HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/vault
Go
>= 1.8.0, <= 1.8.4No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-266, CWE-863
Also known as
BIT-vault-2021-42135, CVE-2021-42135, GO-2022-0578

More Vault advisories

All Vault
Critical 9.1Dec 2, 2021HashiCorp Vault Incorrect Permission Assignment for Critical ResourceCVE-2021-43998fixed in 1.7.6 +1Low 2.9Oct 12, 2021Hashicorp Vault Privilege Escalation VulnerabilityCVE-2021-41802fixed in 1.7.5 +1Critical 9.8Aug 30, 2021HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0CVE-2021-38553fixed in 1.8.0Medium 5.3Aug 30, 2021Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp VaultCVE-2021-38554fixed in 1.6.6 +1High 8.2Aug 2, 2021Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp VaultCVE-2020-16250fixed in 1.2.5 +3High 7.5Jul 28, 2021Improper Resource Shutdown or Release in HashiCorp VaultCVE-2020-7220fixed in 1.3.2