GitHub Advisoryadvisory · Go

GHSA-4mp7-2m29-gqxf HashiCorp Vault Authentication bypass

HIGH Published 2024-01-31 Modified 2024-09-16 Official page ↗
Aliases
CVE-2020-16251
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Weaknesses
CWE-287
Reviewed
2024-01-31

Affected packages

• Go github.com/hashicorp/vault: >= 0.8.3, < 1.2.5 → fixed in 1.2.5 • Go github.com/hashicorp/vault: >= 1.3.0, < 1.3.8 → fixed in 1.3.8 • Go github.com/hashicorp/vault: >= 1.4.0, < 1.4.4 → fixed in 1.4.4 • Go github.com/hashicorp/vault: >= 1.5.0, < 1.5.1 → fixed in 1.5.1

Description

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

Related

Alias · CVE (1)

  • CVE-2020-16251 HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References