Description
Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with `read` permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.18 | vault | 1.9.4-r0 | — |
| Alpine v3.17 | vault | 1.9.4-r0 | — |
| Alpine v3.16 | vault | 1.9.4-r0 | — |
| Alpine v3.15 | vault | 1.9.4-r0 | — |