Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault
High severity
GitHub Reviewed
Published
Aug 2, 2021
to the GitHub Advisory Database
•
Updated Aug 29, 2023
Package
Affected versions
>= 1.5.0, < 1.5.1
>= 0.8.1, < 1.2.5
>= 1.3.0, < 1.3.8
>= 1.4.0, < 1.4.4
Patched versions
1.5.1
1.2.5
1.3.8
1.4.4
Description
Published by the National Vulnerability Database
Aug 26, 2020
Reviewed
Jul 26, 2021
Published to the GitHub Advisory Database
Aug 2, 2021
Last updated
Aug 29, 2023
HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..
References