GHSA-4mp7-2m29-gqxf

Source

https://github.com/advisories/GHSA-4mp7-2m29-gqxf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-4mp7-2m29-gqxf/GHSA-4mp7-2m29-gqxf.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-4mp7-2m29-gqxf

Aliases

Published

2024-01-31T00:21:58Z

Modified

2024-09-16T17:21:31Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CVSS Calculator

Summary

HashiCorp Vault Authentication bypass

Details

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

Database specific

{
    "cwe_ids": [
        "CWE-287"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2020-08-26T15:15:12Z",
    "github_reviewed_at": "2024-01-31T00:21:58Z",
    "severity": "HIGH"
}

References

Affected packages

Go

github.com/hashicorp/vault

Package

Name: github.com/hashicorp/vault; View open source insights on deps.dev
Purl: pkg:golang/github.com/hashicorp/vault

Affected ranges

Type: SEMVER
Events: Introduced

0.8.3

Fixed

1.2.5

github.com/hashicorp/vault

Package

Name: github.com/hashicorp/vault; View open source insights on deps.dev
Purl: pkg:golang/github.com/hashicorp/vault

Affected ranges

Type: SEMVER
Events: Introduced

1.3.0

Fixed

1.3.8

github.com/hashicorp/vault

Package

Name: github.com/hashicorp/vault; View open source insights on deps.dev
Purl: pkg:golang/github.com/hashicorp/vault

Affected ranges

Type: SEMVER
Events: Introduced

1.4.0

Fixed

1.4.4

github.com/hashicorp/vault

Package

Name: github.com/hashicorp/vault; View open source insights on deps.dev
Purl: pkg:golang/github.com/hashicorp/vault

Affected ranges

Type: SEMVER
Events: Introduced

1.5.0

Fixed

1.5.1