Medium WID-SEC-2024-1007 1 CVE

Hashicorp Vault: Schwachstelle ermöglicht Offenlegung von Informationen

Published May 1, 2024 · Updated May 1, 2024 · de-DE

Vendor: HashiCorp Product: Vault Platform: Linux

Summary

Ein lokaler Angreifer kann eine Schwachstelle in Hashicorp Vault ausnutzen, um Informationen offenzulegen.

Product

Vault ist ein identitätsbasiertes System zur Verwaltung von Geheimnissen und Verschlüsselung.

Vulnerabilities 1

Medium 5.5

CVE-2024-2877

Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node

Vault Enterprise, when configured with performance standby nodes and a configured audit device, will inadvertently log request headers on the standby node. These logs may have included sensitive HTTP request information in cleartext. This vulnerability, CVE-2…

HashiCorp Vault Enterprise

Apr 30, 2024

Revision history

2024-05-01 #1
Initiale Fassung

References

HashiCorp Security Advisory vom 2024-05-01
https://discuss.hashicorp.com/t/hsec-2024-10-vault-enterprise-leaks-sensitive-http-request-headers-in-audit-log-when-deployed-with-a-performance-standby-node/66553