Invalid session token expiration
High severity
GitHub Reviewed
Published
Jun 8, 2021
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Package
Affected versions
>= 1.7.0, < 1.7.2
>= 1.6.0, < 1.6.5
>= 0.10.0, < 1.5.9
Patched versions
1.7.2
1.6.5
1.5.9
Description
Published by the National Vulnerability Database
Jun 3, 2021
Reviewed
Jun 4, 2021
Published to the GitHub Advisory Database
Jun 8, 2021
Last updated
Jan 27, 2023
HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
References