GHSA-57gg-cj55-q5g2
Token leases could outlive their TTL in HashiCorp Vault
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/hashicorp/vault | >= 1.0.0-beta1, < 1.5.4 | 1.5.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
HashiCorp Vault and Vault Enterprise 1.0 before 1.5.4 have Incorrect Access Control.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2020-25816
- https://github.com/hashicorp/vault/pull/10020/commits/f192878110fe93eb13da914b2bee28caa7866a29
- https://github.com/hashicorp/vault
- https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#147
- https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#154
- https://www.hashicorp.com/blog/category/vault