GitHub Advisoryadvisory · Go

GHSA-hwc3-3qh6-r4gg HashiCorp Vault's PKI mount vulnerable to denial of service

MEDIUM Published 2023-03-30 Modified 2023-04-07 Official page ↗
Aliases
CVE-2023-0665
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-285
Reviewed
2023-04-07

Affected packages

• Go github.com/hashicorp/vault: < 1.11.9 → fixed in 1.11.9 • Go github.com/hashicorp/vault: >= 1.12.0, < 1.12.5 → fixed in 1.12.5 • Go github.com/hashicorp/vault: >= 1.13.0, < 1.13.1 → fixed in 1.13.1

Description

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

Related

Alias · CVE (1)

  • CVE-2023-0665 HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially… vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References