GHSA-75pc-qvwc-jf3g

Improper Input Validation in HashiCorp Vault

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-12757

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp/vault-plugin-secrets-gcp	< 0.6.2	0.6.2

Details

As written in the advisory (Markdown source, shown as plain text).

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-12757 advisory
https://github.com/hashicorp/vault-plugin-secrets-gcp/pull/85 web
https://github.com/hashicorp/vault-plugin-secrets-gcp/commit/e43d20870c50f7428dead1411debcec075b35fb4 web
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md web
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#142-may-21st-2020 web
https://www.hashicorp.com/blog/category/vault web