[GHSA-7j85-mwfj-2gr8] An unhandled error in Vault Enterprise's namespace...

[anonymous4ACL24]

Updates

• Affected products
• Severity
• Summary

Comments
In reference https://discuss.hashicorp.com/t/hcsec-2023-23-vault-enterprise-namespace-creation-may-lead-to-denial-of-service/56617, it corresponds to the go developer 'HashiCorp' and affects the package Vault.

[darakian]

Based on the description it would seem this only applies to the enterprise version of vault. Do you have any evidence to suggest otherwise?

[anonymous4ACL24]

Based on the description it would seem this only applies to the enterprise version of vault. Do you have any evidence to suggest otherwise?

Similar to my response in https://github.com/github/advisory-database/pull/4187, I think this vulnerability also applies to the open-source versions of Vault.
For example, in the released version 1.14.1 (one of the patch version): https://github.com/hashicorp/vault/releases/tag/v1.14.1, it also mentions: which will have access to some system backend paths that were previously only accessible in the root namespace, corresponding to the details (This operation is generally reserved for privileged operators with read/update permissions to the sys/namespaces path.) of this vulnerability in https://discuss.hashicorp.com/t/hcsec-2023-23-vault-enterprise-namespace-creation-may-lead-to-denial-of-service/56617.
.

[anonymous4ACL24]

Hi, could you take a look at my preceding response?

[darakian]

Do you have evidence you can present that shows the code change applies to the open source version as well? The two projects may share a repo but not all code changes are relevant to all products which emerge from the repo.

[taladrane]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.