GoogleOSV:BIT-VAULT-2020-16251

HistoryMar 06, 2024 - 11:11 a.m.

BIT-vault-2020-16251

2024-03-0611:11:33

Google

osv.dev

hashicorp vault

gcp

authentication

bypass

vulnerability

6.8 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

59.6%

JSON

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

CPENameOperatorVersion
vaultge1.5.0
vaultlt1.3.8
vaultlt1.5.1
vaultge0.8.3
vaultge1.3.0
vaultlt1.2.5
vaultge1.4.0
vaultlt1.4.4

Name	Operator	Version
vault	ge	1.5.0
vault	lt	1.3.8
vault	lt	1.5.1
vault	ge	0.8.3
vault	ge	1.3.0
vault	lt	1.2.5
vault	ge	1.4.0
vault	lt	1.4.4

References

packetstormsecurity.com/files/159479/Hashicorp-Vault-GCP-IAM-Integration-Authentication-Bypass.html

github.com/hashicorp/vault/blob/master/CHANGELOG.md#151

www.hashicorp.com/blog/category/vault/