GitHub Advisoryadvisory · Go

GHSA-362v-wg5p-64w2 Incorrect Privilege Assignment in HashiCorp Vault

HIGH Published 2021-10-12 Modified 2021-10-20 Official page ↗
Aliases
CVE-2021-42135
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-266, CWE-863
Reviewed
2021-10-12

Affected packages

• Go github.com/hashicorp/vault: >= 1.8.0, <= 1.8.4 (no fix yet)

Description

HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.

Related

Alias · CVE (1)

  • CVE-2021-42135 HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google… vulnerability

Weakness · CWE (2)

  • CWE-266 Incorrect Privilege Assignment weakness
  • CWE-863 Incorrect Authorization weakness

References