GHSA-m979-w9wj-qfj9

HashiCorp Vault Improper Privilege Management

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-10660

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp/vault	>= 0.9.0, < 1.3.4	1.3.4

Details

As written in the advisory (Markdown source, shown as plain text).

HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-10660 advisory
https://github.com/hashicorp/vault/pull/8606 web
https://github.com/hashicorp/vault/commit/18485ee9d4352ac8e8396c580b5941ccf8e5b31a web
https://github.com/hashicorp/vault package
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#134-march-19th-2020 web
https://www.hashicorp.com/blog/category/vault web