GHSA-9v3w-w2jh-4hff
HashiCorp Vault and Vault Enterprise vulnerable to user enumeration
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/hashicorp/vault | < 1.13.5 | 1.13.5 |
| Go | github.com/hashicorp/vault | >= 1.14.0, < 1.14.1 | 1.14.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.
References
External links from the advisory. They lead to third-party sites.