Medium WID-SEC-2024-1603 1 CVE

Hashicorp Vault: Schwachstelle ermöglicht Denial of Service

Published Jul 11, 2024 · Updated Jul 11, 2024 · de-DE

Vendor: HashiCorp Product: Vault Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Hashicorp Vault ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Vault ist ein identitätsbasiertes System zur Verwaltung von Geheimnissen und Verschlüsselung.

Vulnerabilities 1

High 7.5

CVE-2024-6468

Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior

Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxy_protocol_behavior, was set to deny_unauthorized. When receiving a request from a source IP address that was not listed i…

HashiCorp Vault Enterprise Vault github.com/hashicorp/vault Go

Jul 11, 2024

Revision history

2024-07-11 #1
Initiale Fassung

References

HashiCorp Security Advisory vom 2024-07-11
https://discuss.hashicorp.com/t/hcsec-2024-14-vault-vulnerable-to-denial-of-service-when-setting-a-proxy-protocol-behavior/68518