CVE-2021-27668

HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3...

CVE-2021-27668

HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed reading license metadata from DR secondaries without authentication. The issue is fixed in 1.6.3. This CVE (CVE-2021-27668) affects the Vault Enterprise license metadata exposure via DR secondary replicas; no authentication was required to ac...

FreeBSD : vault -- unauthenticated license read (52bd2d59-4ab5-4bef-a599-7aac4e92238b)

vault developers report : Limited Unauthenticated License Read: We addressed a security vulnerability that allowed for the unauthenticated reading of Vault licenses from DR Secondaries. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

Vault Enterprise’s DR Secondaries Exposed License Metadata Without Authentication

Summary Vault Enterprise’s /sys/license endpoint allowed the read of license metadata from Vault DR secondaries without authentication. This vulnerability, CVE-2021-27668, was fixed in Vault Enterprise 1.6.3. Background Vault Enterprise nodes expose the /sys/license API endpoint for access to and...