GHSA-c5wc-v287-82pc

HashiCorp Vault improper configuration of multi factor authentication

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-30689

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp/vault	>= 1.10.0, < 1.10.3	1.10.3

Details

As written in the advisory (Markdown source, shown as plain text).

HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-30689 advisory
https://github.com/hashicorp/vault/commit/15baea5fa3e71c837c33b8bcbd8f06e0fbbc110d web
https://discuss.hashicorp.com web
https://github.com/hashicorp/vault web
https://security.gentoo.org/glsa/202207-01 web
https://security.netapp.com/advisory/ntap-20220629-0006 web