GHSA-fp52-qw33-mfmw
Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/hashicorp/vault | >= 0.8.1, < 1.2.5 | 1.2.5 |
| Go | github.com/hashicorp/vault | >= 1.3.0, < 1.3.8 | 1.3.8 |
| Go | github.com/hashicorp/vault | >= 1.4.0, < 1.4.4 | 1.4.4 |
| Go | github.com/hashicorp/vault | >= 1.5.0, < 1.5.1 | 1.5.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..
References
External links from the advisory. They lead to third-party sites.