EFS Backup Policy Fails With "Not authorized to perform DeleteRecoveryPoint"

Challenge An EFS Backup Policy fails with the message: User: arn:aws:sts:::assumed-role/VEEAM-BACKUP-FOR-AWS-IAM-ROLE-NAME/VeeamBackupSession is not authorized to perform: backup:DeleteRecoveryPoint on resource: arn:aws:backup:AWS-REGION::recovery-point: with an explicit deny in a resource-based...

This Week in Spring - 28 November, 2023

Hi, Spring fans! I hope everyone who celebrated Thanksgiving had a wonderful time. Did you indulge in too much turkey? Anyway, let's jump into this week's edition of This Week in Spring—a particularly special one for a couple of reasons. First, it's our first issue after the launch of Spring Boot...

PT-2023-7600 · Hashicorp +2 · Hashicorp Vault +3

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions 1.12.0 through 1.15.3 HashiCorp Vault and Vault Enterprise versions 1.13.0 through 1.13.11 HashiCorp Vault and Vault Enterprise versions 1.14.0 through 1.14.7 Description: The issue is related to...

The vulnerability of HashiCorp’s Vault and Vault Enterprise storage platforms, related to memory leak errors, allows attackers to trigger service interruptions.

The vulnerability of the HashiCorp Vault and Vault Enterprise archiving platforms relates to memory release errors. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

GHSA-2C7C-3MJ9-8FQH vulnerabilities

Vulnerabilities for packages: terragrunt, flux-source-controller, fulcio, spire-server-fips, aactl, kubescape, argo-workflows, gitsign, bank-vaults-fips, falcoctl-fips, slsa-verifier, kots, oauth2-proxy, timestamp-authority-fips, cloudflared, fulcio-fips, dex, tkn, rekor, flux-kustomize-controlle...

GHSA-2C7C-3MJ9-8FQH vulnerabilities

Vulnerabilities for packages: terragrunt, aactl, argo-workflows, kots, cosign, tekton-chains, cloudflared, gitsign, slsa-verifier, flux-source-controller, spire-server, fulcio, sops, rekor, vexctl, dex, oauth2-proxy, tkn, kubescape, flux-kustomize-controller...

Intrinsic arbitrage between assets due to price feed deviation threshold

Lines of code Vulnerability details Impact Withdrawals have not yet been implemented but I assume it will be implemented in the usual way such that the fraction of total supply of rsETH a user redeems gives him an equal fraction of total assets held, i.e. received = sharesToRedeem totalAssets /...

DepositPool is susceptible to the inflation attack

Lines of code Vulnerability details Summary The DepositPool contract is susceptible to the Inflation Attack, in which the first depositor can be front-runned by an attacker to steal their deposit. Impact The DepositPool pool contract acts mainly as a vault: accounts deposit LST assets and get bac...

Denial Of Service (DoS)

github.com/hashicorp/vault is vulnerable to Denial of Service DoS. A memory leak vulnerability allows an attacker to cause a denial-of-service DoS attacks against a vulnerable Vault instance by sending a large number of malicious client requests. The malicious requests would cause Vault to consum...

CVE-2023-5954

A flaw was found in The HashiCorp Vault, which may be susceptible to a denial of service due to an unbounded consumption of memory when handling policy requests. This issue may allow an attacker to trigger policy checks by sending multiple inbound client requests that create a logger that is neve...

HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10...

GHSA-4QHC-V8R6-8VWM HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10...

CVE-2023-5954

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10...

Denial of service

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10...

CVE-2023-5954 Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10...

CVE-2023-5954 Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10...

CVE-2023-5954

CVE-2023-5954 affects HashiCorp Vault and Vault Enterprise. Inbound client requests that trigger a policy check can cause unbounded memory growth, leading to denial of service. Fixes are available in Vault 1.15.2, 1.14.6, and 1.13.10.

Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption

Summary Vault and Vault Enterprise “Vault” inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. Background...

PT-2023-7090 · Hashicorp +1 · Hashicorp Vault +2

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault versions prior to 1.13.10 HashiCorp Vault versions prior to 1.14.6 HashiCorp Vault versions prior to 1.15.2 Vault Enterprise versions prior to 1.13.10 Vault Enterprise versions prior to 1.14.6 Vault Enterprise versions prior t...

HashiCorp Vault Security Breach

HashiCorp Vault is a private key access management tool from the US-based HashiCorp. A security vulnerability exists in HashiCorp Vault , Vault Enterprise versions 1.15.2, 1.14.6, and 1.13.10, which stems from a client-side inbound request that triggers a policy check that may result in unlimited...