GHSA-38j9-7pp9-2hjw
Invalid session token expiration
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/hashicorp/vault | >= 1.7.0, < 1.7.2 | 1.7.2 |
| Go | github.com/hashicorp/vault | >= 1.6.0, < 1.6.5 | 1.6.5 |
| Go | github.com/hashicorp/vault | >= 0.10.0, < 1.5.9 | 1.5.9 |
Details
As written in the advisory (Markdown source, shown as plain text).
HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
References
External links from the advisory. They lead to third-party sites.