GitHub Advisoryadvisory · Go

GHSA-9vh5-r4qw-v3vv Improper Resource Shutdown or Release in HashiCorp Vault

HIGH Published 2021-07-28 Modified 2021-07-27 Official page ↗
Aliases
CVE-2020-7220
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-404
Reviewed
2021-07-27

Affected packages

• Go github.com/hashicorp/vault: >= 0.11.0, < 1.3.2 → fixed in 1.3.2

Description

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.

Related

Alias · CVE (1)

  • CVE-2020-7220 HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted… vulnerability

Weakness · CWE (1)

  • CWE-404 Improper Resource Shutdown or Release weakness

References