~ / search / GHSA-jg74-mwgw-v6x3

GHSA-jg74-mwgw-v6x3

Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default

Source: GitHub Advisory Database (reviewed) High CVE-2024-7594

Packages

EcosystemPackageAffectedFixed in
Go github.com/hashicorp/vault >= 1.7.7, < 1.17.6 1.17.6
Go github.com/openbao/openbao < 2.0.2 no fix listed
Go github.com/openbao/openbao < 0.0.0-20241003222810-d5b4e9224698 0.0.0-20241003222810-d5b4e9224698

Details

As written in the advisory (Markdown source, shown as plain text).

Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.

References

External links from the advisory. They lead to third-party sites.