Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Hashicorp Vault ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um Informationen offenzulegen.
Product
Vault ist ein identitätsbasiertes System zur Verwaltung von Geheimnissen und Verschlüsselung.
Vulnerabilities 2
-
Medium 6.6
Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login
Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enter…
-
Medium 4.5
Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin
Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulner…
Revision history
-
#1
Initiale Fassung
References
-
Hashicorp Security Bulletin vom 2025-05-04
https://discuss.hashicorp.com/t/hcsec-2025-07-vault-s-azure-authentication-method-bound-location-restriction-could-be-bypassed-on-login/74716
-
GitHub Advisory Database vom 2025-05-04
https://github.com/advisories/GHSA-f9ch-h8j7-8jwg
-
Hashicorp Security Bulletin vom 2025-05-04
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717
-
GitHub Advisory Database vom 2025-05-04
https://github.com/advisories/GHSA-gcqf-f89c-68hv