AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

VaultGHSA-9vh5-r4qw-v3vv

Improper Resource Shutdown or Release in HashiCorp Vault

Vault

CVE-2020-7220 · Published Jul 28, 2021 · updated Aug 21, 2024

High7.5
Fix: upgrade to 1.3.2 or later
GitHub advisory

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/vault
Go
>= 0.11.0, < 1.3.21.3.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-404
Also known as
BIT-vault-2020-7220, CVE-2020-7220, GO-2022-0816

More Vault advisories

All Vault
Low 2.9Oct 12, 2021Hashicorp Vault Privilege Escalation VulnerabilityCVE-2021-41802fixed in 1.7.5 +1Critical 9.8Aug 30, 2021HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0CVE-2021-38553fixed in 1.8.0Medium 5.3Aug 30, 2021Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp VaultCVE-2021-38554fixed in 1.6.6 +1High 8.2Aug 2, 2021Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp VaultCVE-2020-16250fixed in 1.2.5 +3High 7.4Jun 8, 2021Invalid session token expirationCVE-2021-32923fixed in 1.5.9 +2High 7.5May 18, 2021Information Disclosure in HashiCorp VaultCVE-2020-13223fixed in 1.3.6 +1