GitHub Advisoryadvisory · Go

GHSA-23fq-q7hc-993r HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0

CRITICAL Published 2021-08-30 Modified 2022-08-11 Official page ↗
Aliases
CVE-2021-38553
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-281
Reviewed
2021-08-30

Affected packages

• Go github.com/hashicorp/vault: >= 1.4.0, < 1.8.0 → fixed in 1.8.0

Description

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.

Related

Alias · CVE (1)

  • CVE-2021-38553 HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage… vulnerability

Weakness · CWE (1)

  • CWE-281 Improper Preservation of Permissions weakness

References