Skip to content
OpenAdvisories

Package · Alpine

vault

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.4
    CVE-2021-32923

    Invalid session token expiration

    HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fi…

    github.com/hashicorp/vault vault Alpine Go
  • High 7.5
    CVE-2021-3282

    Improper Authentication in HashiCorp Vault

    HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

    github.com/hashicorp/vault vault Alpine Go
  • High 8.2
    CVE-2020-16251

    HashiCorp Vault Authentication bypass

    HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

    github.com/hashicorp/vault vault Alpine Go
  • High 8.2
    CVE-2020-16250

    Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault

    HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

    github.com/hashicorp/vault vault Alpine Go
  • High 7.5
    CVE-2020-13223

    Information Disclosure in HashiCorp Vault

    HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2.

    github.com/hashicorp/vault vault Alpine Go