Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS00bXA3LTJtMjktZ3F4Zs4AA49E
HashiCorp Vault Authentication bypass
HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.
Permalink: https://github.com/advisories/GHSA-4mp7-2m29-gqxfJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00bXA3LTJtMjktZ3F4Zs4AA49E
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 3 months ago
Updated: 3 months ago
CVSS Score: 8.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Identifiers: GHSA-4mp7-2m29-gqxf, CVE-2020-16251
References:
- https://nvd.nist.gov/vuln/detail/CVE-2020-16251
- https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151
- https://www.hashicorp.com/blog/category/vault/
- http://packetstormsecurity.com/files/159479/Hashicorp-Vault-GCP-IAM-Integration-Authentication-Bypass.html
- https://github.com/advisories/GHSA-4mp7-2m29-gqxf
Blast Radius: 1.0
Affected Packages
go:github.com/hashicorp/vault/vault
Affected Version Ranges: >= 1.5.0, < 1.5.1, >= 1.4.0, < 1.4.4, >= 1.3.0, < 1.3.8, >= 0.8.3, < 1.2.5Fixed in: 1.5.1, 1.4.4, 1.3.8, 1.2.5