Medium WID-SEC-2023-0627 1 CVE

Hashicorp Vault: Schwachstelle ermöglicht Denial of Service

Published Mar 12, 2023 · Updated Mar 12, 2023 · de-DE

Vendor: HashiCorp Product: Vault Product: Vault < 1.10.11 Product: Vault < 1.11.8 Product: Vault < 1.12.4 Product: Vault < 1.13.0 Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Hashicorp Vault ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Vault ist ein identitätsbasiertes System zur Verwaltung von Geheimnissen und Verschlüsselung.

Vulnerabilities 1

Medium 4.4

CVE-2023-24999

Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation

HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1…

HashiCorp Vault Enterprise Vault k3d Wolfi Go

Mar 10, 2023

Revision history

2023-03-12 #1
Initiale Fassung

References

Hashicorp Vault Security Advisory vom 2023-03-12
https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305