GHSA-23fq-q7hc-993r

Source

https://github.com/advisories/GHSA-23fq-q7hc-993r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-23fq-q7hc-993r/GHSA-23fq-q7hc-993r.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-23fq-q7hc-993r

Aliases

Published

2021-08-30T17:22:53Z

Modified

2024-08-21T15:27:16.862926Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0

Details

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.

Database specific

{
    "nvd_published_at": "2021-08-13T16:15:00Z",
    "cwe_ids": [
        "CWE-281"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-30T17:16:42Z"
}

References

Affected packages

Go / github.com/hashicorp/vault

Package

Name: github.com/hashicorp/vault; View open source insights on deps.dev
Purl: pkg:golang/github.com/hashicorp/vault

Affected ranges

Type: SEMVER
Events: Introduced

1.4.0

Fixed

1.8.0