Critical · 9.8 CVE-2021-38553 BIT-vault-2021-38553EUVD-2021-1503GHSA-23fq-q7hc-993rGO-2022-0620

HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0

Published Aug 13, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Package: github.com/hashicorp/vault Ecosystem: Go

Description

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	github.com/hashicorp/vault	>= 1.4.0, < 1.8.0	1.8.0	GHSA-23fq-q7hc-993r

References

https://discuss.hashicorp.com/t/hcsec-2021-20-vault-s-integrated-storage-backend-database-file-may-have-excessively-broad-permissions/28168
GLSA-202207-01 vendor-advisory