CVE-2021-45042

A denial of service attack was discovered against vault. For clusters using the Integrated Storage Raft backend, an authenticated user with write permissions to the KV secrets engine can cause a panic leading to a denial of service of the storage backend, by supplying a key larger than 32KB...

CVE-2021-45042

In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user with write permissions to a kv secrets engine to cause a panic and denial of service of the storage backend. The earliest...

CVE-2021-45042

In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user with write permissions to a kv secrets engine to cause a panic and denial of service of the storage backend. The earliest...

PT-2021-24194 · Hashicorp · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions 1.4.0 through 1.7.6 HashiCorp Vault and Vault Enterprise versions 1.8.0 through 1.8.5 HashiCorp Vault and Vault Enterprise versions 1.9.0 Description: The issue allows an authenticated user with...

Vault’s KV Secrets Engine With Integrated Storage Exposed to Authenticated Denial of Service

Summary It was reported that for Vault and Vault Enterprise “Vault” clusters using the Integrated Storage backend could be caused to crash by an authenticated user with write permissions to the KV secrets engine. This vulnerability, CVE-2021-45042, was fixed in Vault 1.7.7, 1.8.6, and 1.9.1...