Description
HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.18 | vault | 1.7.2-r0 | — |
| Alpine v3.17 | vault | 1.7.2-r0 | — |
| Alpine v3.16 | vault | 1.7.2-r0 | — |
| Alpine v3.15 | vault | 1.7.2-r0 | — |
| Alpine v3.14 | vault | 1.7.2-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.13 | vault | 1.5.9-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | k3d +2 | 5.6.0-r11 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/hashicorp/vault | >= 1.7.0, < 1.7.2 | 1.7.2 | GHSA-38j9-7pp9-2hjw |
| Go | github.com/hashicorp/vault | >= 1.6.0, < 1.6.5 | 1.6.5 | GHSA-38j9-7pp9-2hjw |
| Go | github.com/hashicorp/vault | >= 0.10.0, < 1.5.9 | 1.5.9 | GHSA-38j9-7pp9-2hjw |
| Go | github.com/hashicorp/vault | >= 0.10.0, < 1.5.9 · >= 1.6.0, < 1.6.5 · >= 1.7.0, < 1.7.2 | 1.5.9, 1.6.5, 1.7.2 | GO-2022-0623 |