GitHub Advisoryadvisory · Go

GHSA-pfmw-vj74-ph8g HashiCorp Vault Incorrect Permission Assignment for Critical Resource

CRITICAL Published 2021-12-02 Modified 2022-08-10 Official page ↗
Aliases
CVE-2021-43998
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-732
Reviewed
2021-12-01

Affected packages

• Go github.com/hashicorp/vault: >= 0.11.0, < 1.7.6 → fixed in 1.7.6 • Go github.com/hashicorp/vault: >= 1.8.0, < 1.8.5 → fixed in 1.8.5

Description

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.

Related

Alias · CVE (1)

  • CVE-2021-43998 HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias… vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References