AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

VaultGHSA-rpgp-9hmg-j25x

Enumeration of users in HashiCorp Vault

Vault

CVE-2020-35177 · Published Jan 31, 2024 · updated Jun 28, 2024

Medium6.5
Fix: upgrade to 1.5.6 or later (2 fixed versions below)
GitHub advisory

HashiCorp Vault and Vault Enterprise allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/vault
Go
>= 1.5.0, < 1.5.61.5.6
>= 1.6.0, < 1.6.11.6.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:R
Severity from
GitHub (reviewed advisory)
Weakness
CWE-200
Also known as
BIT-vault-2020-35177, CVE-2020-35177, GO-2024-2508

More Vault advisories

All Vault
High 8.1Mar 4, 2024Incorrect TLS certificate auth method in VaultCVE-2024-2048fixed in 1.14.10 +1Medium 4.5Feb 1, 2024Hashicorp Vault may expose sensitive log informationCVE-2024-0831fixed in 1.15.5High 7.5Jan 31, 2024Improper Authentication in HashiCorp VaultCVE-2021-3282fixed in 1.6.2High 8.2Jan 31, 2024HashiCorp Vault Authentication bypassCVE-2020-16251fixed in 1.2.5 +3Medium 5.3Jan 30, 2024HashiCorp Vault Improper Privilege ManagementCVE-2020-10660fixed in 1.3.4Critical 9.1Jan 30, 2024HashiCorp Vault Improper Privilege ManagementCVE-2020-10661fixed in 1.3.4