AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

VaultGHSA-rq95-xf66-j689

Improper Authentication in HashiCorp Vault

Vault

CVE-2021-3282 · Published Jan 31, 2024 · updated Jun 28, 2024

High7.5
Fix: upgrade to 1.6.2 or later
GitHub advisory

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/vault
Go
>= 1.6.0, < 1.6.21.6.2
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-287
Also known as
BIT-vault-2021-3282, CVE-2021-3282, GO-2024-2509

More Vault advisories

All Vault
High 8.1Mar 4, 2024Incorrect TLS certificate auth method in VaultCVE-2024-2048fixed in 1.14.10 +1Medium 4.5Feb 1, 2024Hashicorp Vault may expose sensitive log informationCVE-2024-0831fixed in 1.15.5Medium 6.5Jan 31, 2024Enumeration of users in HashiCorp VaultCVE-2020-35177fixed in 1.5.6 +1High 8.2Jan 31, 2024HashiCorp Vault Authentication bypassCVE-2020-16251fixed in 1.2.5 +3Medium 5.3Jan 30, 2024HashiCorp Vault Improper Privilege ManagementCVE-2020-10660fixed in 1.3.4Critical 9.1Jan 30, 2024HashiCorp Vault Improper Privilege ManagementCVE-2020-10661fixed in 1.3.4