Advisoriesby IbisVaultGHSA-9mh8-9j64-443f
HashiCorp Vault's revocation list not respected
Fix: upgrade to 1.9.10 or later (3 fixed versions below)
HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/vault Go | >= 1.11.0, < 1.11.4 | 1.11.4 |
| >= 1.10.0, < 1.10.7 | 1.10.7 | |
| < 1.9.10 | 1.9.10 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-295
- Also known as
- BIT-vault-2022-41316, CVE-2022-41316, GO-2023-1897
More Vault advisories
All Vault
Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerabilityCVE-2023-5077fixed in 1.13.0HashiCorp Vault Improper Input Validation vulnerabilityCVE-2023-4680fixed in 1.12.11 +2HashiCorp Vault and Vault Enterprise vulnerable to user enumerationCVE-2023-3462fixed in 1.13.5 +1Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy OperationCVE-2023-24999fixed in 1.10.11 +2Hashicorp Vault vulnerable to Cross-site ScriptingCVE-2023-2121fixed in 1.11.11 +2HashiCorp Vault's PKI mount vulnerable to denial of serviceCVE-2023-0665fixed in 1.11.9 +2