BIT-VAULT-2023-0665 Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault...

BIT-VAULT-2023-2121 Vault’s KV Diff Viewer Allowed for HTML Injection

Vault and Vault Enterprise's Vault key-value v2 kv-v2 diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11...

BIT-VAULT-2023-24999 Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation

HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above...

BIT-VAULT-2023-25000 Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a...

BIT-VAULT-2023-3462 Vault's LDAP Auth Method Allows for User Enumeration

HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed i...

BIT-VAULT-2023-3774 Vault Enterprise Namespace Creation May Lead to Denial of Service

An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service. Fixed in 1.14.1, 1.13.5, and 1.12.9...

BIT-VAULT-2023-3775 Vault Enterprise's Sentinel RGP Policies Allowed For Cross-Namespace Denial of Service

A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potentially resulting in denial of service. Fixed in Vault Enterprise 1.15.0, 1.14.4, 1.13.8...

BIT-VAULT-2023-4680 Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the...

BIT-VAULT-2023-5077 Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets

The Vault and Vault Enterprise "Vault" Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0...

BIT-VAULT-2023-5954 Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10...

BIT-VAULT-2023-6337 Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests

HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of...

BIT-VAULT-2024-0831 Vault May Expose Sensitive Information When Configuring An Audit Log Device

Vault and Vault Enterprise “Vault” may expose sensitive information when enabling an audit device which specifies the lograw option, which may log sensitive information to other audit devices, regardless of whether they are configured to use lograw...

The vulnerability of the MSSQL Database Storage Backend component in the platform for archiving corporate information, HashiCorp Vault and Vault Enterprise, allows a perpetrator to execute arbitrary SQL commands.

The vulnerability of the MSSQL Database Storage Backend component in the HashiCorp Vault and Vault Enterprise archiving platforms relates to the lack of security measures for SQL query structures. Exploiting this vulnerability allows attackers to execute arbitrary SQL commands...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: kots, prometheus-node-exporter-fips, cilium-cli, crossplane-provider-aws-kinesis, crossplane-provider-aws, ip-masq-agent, flux-kustomize-controller, trust-manager, aactl, prometheus-redis-exporter-fips, flux-image-reflector-controller, newrelic-nri-kube-events,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: q, yam, docker-cli, kubeflow-pipelines, nri-mysql, fuse-overlayfs-snapshotter, yq, scorecard, direnv, haproxy-ingress, nats, gitness, temporal-server, ytt, kube-bench, docker-credential-acr-env, docker-credential-gcr, grype, nodetaint, stakater-reloader, go-licenses,...

GHSA-R3W7-MFPM-C2VW Incorrect TLS certificate auth method in Vault

Vault and Vault Enterprise “Vault” TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass...

GHSA-R3W7-MFPM-C2VW vulnerabilities

Vulnerabilities for packages: k3d...

Incorrect TLS certificate auth method in Vault

Vault and Vault Enterprise “Vault” TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: kots, caddy, temporal-server-fips, trillian-fips, argo-workflows, wavefront-collector-for-kubernetes, trillian, ferretdb, step-ca, step, falcosidekick-fips, kube-bench, src, kine, k3s, temporal-server, kube-bench-fips, amass, argo-workflows-fips, caddy-fips, spicedb...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: kots, caddy, temporal-server-fips, trillian-fips, argo-workflows, wavefront-collector-for-kubernetes, trillian, ferretdb, step-ca, step, falcosidekick-fips, kube-bench, src, kine, k3s, temporal-server, kube-bench-fips, amass, argo-workflows-fips, caddy-fips, spicedb...