~ / search / GHSA-rpgp-9hmg-j25x

GHSA-rpgp-9hmg-j25x

Enumeration of users in HashiCorp Vault

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-35177

Packages

EcosystemPackageAffectedFixed in
Go github.com/hashicorp/vault >= 1.5.0, < 1.5.6 1.5.6
Go github.com/hashicorp/vault >= 1.6.0, < 1.6.1 1.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

HashiCorp Vault and Vault Enterprise allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

References

External links from the advisory. They lead to third-party sites.