Skip to content
OpenAdvisories

Package · Alpine

vault

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

16 results · Feed

  • Low 2.5
    CVE-2023-2197

    Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM

    HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able…

    HashiCorp Vault Enterprise vault Alpine
  • Medium 5.3
    CVE-2022-41316

    HashiCorp Vault's revocation list not respected

    HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. F…

    github.com/hashicorp/vault vault Alpine Go
  • Unscored —
    CVE-2022-25243

    "Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations …

    vault Alpine
  • Unscored —
    CVE-2022-25244

    Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokeniza…

    vault Alpine
  • Unscored —
    CVE-2021-27668

    HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authent…

    vault Alpine
  • Medium 5.3
    CVE-2021-38554

    Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault

    HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.

    github.com/hashicorp/vault vault Alpine Go
  • High 7.4
    CVE-2021-32923

    Invalid session token expiration

    HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fi…

    github.com/hashicorp/vault vault Alpine Go
  • Unscored —
    CVE-2021-27400

    HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did no…

    vault Alpine
  • Unscored —
    CVE-2021-3024

    HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invali…

    vault Alpine
  • Unscored —
    CVE-2020-25594

    HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP req…

    vault Alpine
  • High 7.5
    CVE-2021-3282

    Improper Authentication in HashiCorp Vault

    HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

    github.com/hashicorp/vault vault Alpine Go
  • Medium 6.5
    CVE-2020-35177

    Enumeration of users in HashiCorp Vault

    HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

    github.com/hashicorp/vault vault Alpine Go
  • Critical 9.8
    CVE-2020-25816

    Token leases could outlive their TTL in HashiCorp Vault

    HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.

    github.com/hashicorp/vault vault Alpine Go
  • High 8.2
    CVE-2020-16251

    HashiCorp Vault Authentication bypass

    HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

    github.com/hashicorp/vault vault Alpine Go
  • High 8.2
    CVE-2020-16250

    Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault

    HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

    github.com/hashicorp/vault vault Alpine Go
  • High 7.5
    CVE-2020-13223

    Information Disclosure in HashiCorp Vault

    HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2.

    github.com/hashicorp/vault vault Alpine Go