GitHub Advisoryadvisory · Go

GHSA-25xj-89g5-fm6h Information Disclosure in HashiCorp Vault

HIGH Published 2021-05-18 Modified 2023-10-02 Official page ↗
Aliases
CVE-2020-13223
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-532
Reviewed
2021-05-13

Affected packages

• Go github.com/hashicorp/vault: >= 1.3.0, < 1.3.6 → fixed in 1.3.6 • Go github.com/hashicorp/vault: >= 1.4.0, < 1.4.2 → fixed in 1.4.2

Description

HashiCorp Vault and Vault Enterprise before 1.3.6, and 1.4.2 before 1.4.2, insert Sensitive Information into a Log File. The vulnerability is affecting `github.com/hashicorp/vault/command` Go package.

Related

Alias · CVE (1)

  • CVE-2020-13223 HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References