Man-in-the-middle (MitM)

2021-04-2302:10:37

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

35.9%

JSON

github.com/hashicorp/vault is vulnerable to man-in-the-middle attack. The vulnerability exists due to missing hostnames validation when TLS is used to connect to Cassandra clusters.

CPENameOperatorVersion
github.com/hashicorp/vaultlev1.7.0
github.com/hashicorp/vaultlev1.6.3
vault:edgeeq1.3.2-r0
vault:edgeeq1.5.7-r0
vault:edgeeq1.7.0-r0
vault:edgeeq1.4.1-r1
vault:edgeeq1.3.4-r0
vault:edgeeq1.3.3-r0
vault:edgeeq1.4.2-r0
vault:edgeeq1.6.3-r0

Name	Operator	Version
github.com/hashicorp/vault	le	v1.7.0
github.com/hashicorp/vault	le	v1.6.3
vault:edge	eq	1.3.2-r0
vault:edge	eq	1.5.7-r0
vault:edge	eq	1.7.0-r0
vault:edge	eq	1.4.1-r1
vault:edge	eq	1.3.4-r0
vault:edge	eq	1.3.3-r0
vault:edge	eq	1.4.2-r0
vault:edge	eq	1.6.3-r0