Description
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Spring Vault, Spring Cloud Vault, Spring Cloud Config | Spring Vault (3.0.0 to 3.0.1, 2.3.0 to 2.3.2), Spring Cloud Vault (4.0.0, 3.1.0 to 3.1.2 and older versions), Spring Cloud Config (4.0.0 to 4.0.1, 3.1.0 to 3.1.6 and older versions) | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.vault:spring-vault-core | >= 3.0.0, < 3.0.2 | 3.0.2 | GHSA-r47r-87p9-8jh3 |
| Maven | org.springframework.vault:spring-vault-core | < 2.3.3 | 2.3.3 | GHSA-r47r-87p9-8jh3 |