GitHub Advisoryadvisory · Go

GHSA-fp52-qw33-mfmw Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault

HIGH Published 2021-08-02 Modified 2023-08-29 Official page ↗
Aliases
CVE-2020-16250
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Weaknesses
CWE-290, CWE-345
Reviewed
2021-07-26

Affected packages

• Go github.com/hashicorp/vault: >= 0.8.1, < 1.2.5 → fixed in 1.2.5 • Go github.com/hashicorp/vault: >= 1.3.0, < 1.3.8 → fixed in 1.3.8 • Go github.com/hashicorp/vault: >= 1.4.0, < 1.4.4 → fixed in 1.4.4 • Go github.com/hashicorp/vault: >= 1.5.0, < 1.5.1 → fixed in 1.5.1

Description

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

Related

Alias · CVE (1)

  • CVE-2020-16250 HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to… vulnerability

Weakness · CWE (2)

  • CWE-290 Authentication Bypass by Spoofing weakness
  • CWE-345 Insufficient Verification of Data Authenticity weakness

References