GitHub Advisoryadvisory · Go
GHSA-75pc-qvwc-jf3g Improper Input Validation in HashiCorp Vault
CRITICAL
Official page ↗
- Aliases
- CVE-2020-12757
- Ecosystem
- Go
- Packages
- github.com/hashicorp/vault-plugin-secrets-gcp
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-20
- Reviewed
- 2021-05-13
Affected packages
• Go github.com/hashicorp/vault-plugin-secrets-gcp: < 0.6.2 → fixed in 0.6.2
Description
HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control.
Related
Alias · CVE (1)
- CVE-2020-12757 HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-12757 advisory
- https://github.com/hashicorp/vault-plugin-secrets-gcp/pull/85 web
- https://github.com/hashicorp/vault-plugin-secrets-gcp/commit/e43d20870c50f7428dead1411debcec075b35fb4 web
- https://github.com/hashicorp/vault/blob/master/CHANGELOG.md web
- https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#142-may-21st-2020 web
- https://www.hashicorp.com/blog/category/vault web