GHSA-pfmw-vj74-ph8g

HashiCorp Vault Incorrect Permission Assignment for Critical Resource

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-43998

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hashicorp/vault	>= 0.11.0, < 1.7.6	1.7.6
Go	github.com/hashicorp/vault	>= 1.8.0, < 1.8.5	1.8.5

Details

As written in the advisory (Markdown source, shown as plain text).

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-43998 advisory
https://discuss.hashicorp.com/t/hcsec-2021-30-vaults-templated-acl-policies-matched-first-created-alias-per-entity-and-auth-backend/32132 web
https://github.com/hashicorp/vault package
https://security.gentoo.org/glsa/202207-01 web