GitHub Advisoryadvisory · Go

GHSA-9mh8-9j64-443f HashiCorp Vault's revocation list not respected

MEDIUM Published 2023-07-06 Modified 2025-05-15 Official page ↗
Aliases
CVE-2022-41316
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-295
Reviewed
2023-07-06

Affected packages

• Go github.com/hashicorp/vault: >= 1.11.0, < 1.11.4 → fixed in 1.11.4 • Go github.com/hashicorp/vault: >= 1.10.0, < 1.10.7 → fixed in 1.10.7 • Go github.com/hashicorp/vault: < 1.9.10 → fixed in 1.9.10

Description

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.

Related

Alias · CVE (1)

  • CVE-2022-41316 HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References