Advisoriesby IbisVaultGHSA-7cgv-v83v-rr87
HashiCorp Vault vulnerable to incorrect metadata access
Fix: upgrade to 1.9.9 or later (3 fixed versions below)
An issue was discovered in HashiCorp Vault and Vault Enterprise before 1.11.3. A vulnerability in the Identity Engine was found where, in a deployment where an entity has multiple mount accessors with shared alias names, Vault may overwrite metadata to the wrong alias due to an issue with checking the proper alias assigned to an entity. This may allow for unintended access to key/value paths using that metadata in Vault.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/vault Go | >= 1.11.0, < 1.11.3 | 1.11.3 |
| >= 1.10.0, < 1.10.6 | 1.10.6 | |
| >= 1.8.0, < 1.9.9 | 1.9.9 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-639
- Also known as
- BIT-vault-2022-40186, CVE-2022-40186, GO-2022-1021
More Vault advisories
All Vault
Hashicorp Vault vulnerable to Cross-site ScriptingCVE-2023-2121fixed in 1.11.11 +2HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacksCVE-2023-25000fixed in 1.11.9 +2HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration FileCVE-2023-0620fixed in 1.11.9 +2HashiCorp Vault's PKI mount vulnerable to denial of serviceCVE-2023-0665fixed in 1.11.9 +2Token leases could outlive their TTL in HashiCorp VaultCVE-2020-25816fixed in 1.5.4HashiCorp Vault improper configuration of multi factor authenticationCVE-2022-30689fixed in 1.10.3