Summary
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Hashicorp Vault ausnutzen, um einen Denial of Service Angriff durchzuführen.
Product
Vault ist ein identitätsbasiertes System zur Verwaltung von Geheimnissen und Verschlüsselung.
Vulnerabilities 1
-
High 7.5
Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests
HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memor…
Revision history
-
#1
Initiale Fassung
References
-
HashiCorp Security vom 2023-12-10
https://discuss.hashicorp.com/t/hcsec-2023-34-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-handling-large-http-requests/60741
-
RedHat Bugzilla vom 2023-12-10
https://bugzilla.redhat.com/show_bug.cgi?id%253D2253848
-
GitHub Advisory Database vom 2023-12-10
https://github.com/advisories/GHSA-6p62-6cg9-f5f5