CVE-2022-25243

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allowsubdomains is set to false. Fixed in Vault Enterprise 1.8.9...

Design/Logic Flaw

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allowsubdomains is set to false. Fixed in Vault Enterprise 1.8.9...

Code injection

Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with read permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10...

CVE-2022-25243

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allowsubdomains is set to false. Fixed in Vault Enterprise 1.8.9...

HashiCorp Vault 安全漏洞

Hashicorp HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp. A security vulnerability exists in HashiCorp Vault Enterprise, which arises when a Vault Enterprise cluster exposes a tokenized key via a tokenized key configuration endpoint to an operator with "read"...

HashiCorp Vault 信任管理问题漏洞

HashiCorp Vault is a private key access management tool from the US-based HashiCorp. HashiCorp Vault versions 1.8.0 through 1.8.8 and 1.9.3 have a trust management issue vulnerability that allows the PKI confidentiality engine to issue wildcard certificates to authorized users in specified domain...

CVE-2022-25243

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allowsubdomains is set to false. Fixed in Vault Enterprise 1.8.9...

CVE-2022-25243

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allowsubdomains is set to false. Fixed in Vault Enterprise 1.8.9...

CVE-2022-25243

CVE-2022-25243 affects HashiCorp Vault and Vault Enterprise: PKI secrets engine could issue wildcard certificates to authorized users under certain configurations, even when allow_subdomains is false. Impacted are Vault and Vault Enterprise versions 1.8.0–1.8.8 and 1.9.3. Root cause: PKI configur...

CVE-2022-25244

Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with read permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10...

CVE-2022-25244

The vulnerability CVE-2022-25244 affects HashiCorp Vault Enterprise clusters using the tokenization transform feature. The tokenization key can be exposed via the tokenization key configuration endpoint to authorized operators with read permissions, enabling disclosure of sensitive material. Affe...

CVE-2022-25244

Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with read permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10...

CVE-2022-25244

Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with read permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10...

PT-2022-17174 · Hashicorp · Vault Enterprise +1

Name of the Vulnerable Software and Affected Versions: Vault and Vault Enterprise versions 1.8.0 through 1.8.8 Vault and Vault Enterprise version 1.9.3 Description: The issue allowed the PKI secrets engine to issue wildcard certificates to authorized users for a specified domain, even if the PKI...

PT-2022-17175 · Hashicorp · Vault Enterprise

Name of the Vulnerable Software and Affected Versions: Vault Enterprise versions prior to 1.7.10 Vault Enterprise versions prior to 1.8.9 Vault Enterprise versions prior to 1.9.4 Description: The issue affects Vault Enterprise clusters that use the tokenization transform feature, potentially...

Vault PKI Secrets Engine Policy Results In Incorrect Wildcard Certificate Issuance

Summary Vault and Vault Enterprise “Vault” allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allowsubdomains is set to false. This vulnerability, CVE-2022-25243, was fixed in...

Vault Enterprise’s Tokenization Transform Configuration Endpoint May Expose Transform Key

Summary Vault Enterprise “Vault” clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with read permissions on this endpoint. This vulnerability, CVE-2022-25244, was fixed in Vault Enterprise...

Information Disclosure

hashicorp-vault-plugin is vulnerable to information disclosure. Remote unauthenticated attackers are able to gain access to sensitive information by controlling agent processes to obtain Vault secrets via an attacker-specified path and key...

Jenkins HashiCorp Vault Plugin信息泄露漏洞

Jenkins is a Jenkins open source application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins HashiCorp Vault Plugin 3.8.0 and earlier versions are vulnerable to an information disclosure vulnerability that...

Unchecked feiAmount range

Lines of code Vulnerability details Impact BoosValue could be not safe. Proof of Concept The variable feiAmount is not used during the logic of the method canSafeBoostVault. According to the comment: The amount of Fei asset to check the Safe is authorized boost the Vault with. So this argument mu...