Vault's GCP Secrets Engine Service Account Keys Not Enforcing Configured TTL

Summary Vault and Vault Enterprise versions 1.3.5/1.4.0 through 1.4.2, configured with the GCP Secrets Engine may, under certain circumstances, incorrectly generate GCP Credentials with the default time-to-live lease duration, instead of the engine configured setting. This may lead to generated G...

Nomad's Raw File View Vulnerable to Cross-Site Scripting

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that files from a malicious workload could cause arbitrary JavaScript to execute in the web UI. This vulnerability, CVE-2020-10944, affects all Nomad versions since 0.3 and is fixed in the 0.10.5 release. Background...

Vault Enterprise Prefixed Mount Policies May Result In Unauthorized Namespace Access

Summary A vulnerability was identified in Vault Enterprise such that, under certain circumstances, existing nested-path policies may give access to Namespaces created after-the-fact. This vulnerability, CVE-2020-10661, affects Vault Enterprise versions 0.11 and newer and is fixed in 1.3.4...

Vault Auth Groups Not Removed In Certain Circumstances

Summary A vulnerability was identified in Vault and Vault Enterprise “Vault” such that, under certain circumstances, an Entity’s Group membership may inadvertently include external Groups the Entity no longer has permissions to. This vulnerability, CVE-2020-10660, affects Vault and Vault Enterpri...

Nomad's mTLS Authorization Mechanism Susceptible to Privilege Escalation

Summary Nomad and Nomad Enterprise “Nomad” up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Assigned CVE-2020-7956, this vulnerability was fixed in Nomad 0.10.3. Background Securing Nomad’s cluster...

Consul's Health Check API Endpoints May Disclose Information

Summary Consul and Consul Enterprise “Consul” did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. This vulnerability affected Consul versions 1.4.1 through 1.6.2 and was assigned CVE-2020-7955. Background Consul uses Access Control...

Vault Enterprise’s Dynamic Secrets May Persist After Namespace Deletion

Summary A vulnerability was identified in Vault Enterprise such that when deleting a namespace, in certain circumstances, the deletion process will fail to revoke dynamic secrets for a mount in that namespace. This vulnerability, CVE-2020-7220, affects Vault Enterprise 0.11.0 and newer and is fix...

Consul’s HTTP/RPC Services Allow Unbounded Resource Usage, Susceptible to Unauthenticated Denial of Service

Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that unbounded resource usage, triggered by the establishment of many unauthenticated HTTP or RPC connections, may generate excessive load and/or crash the server. This vulnerability, CVE-2020-7219, affects all...

Nomad’s HTTP/RPC Services Allow Unbounded Resource Usage, Susceptible to Unauthenticated Denial of Service

Summary A vulnerability was identified in Nomad and Nomad Enterprise “Nomad” such that unbounded resource usage, triggered by the establishment of many unauthenticated HTTP or RPC connections, may generate excessive load and/or crash the server. This vulnerability, CVE-2020-7218, affects all...