CVE-2020-10661: HashiCorp Vault Improper Privilege Management
HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.
Published Jan 30, 2024 · Updated Sep 16, 2024
Affected packages
github.com/hashicorp/vault
- Ecosystem
- Go
- Affected
- >= 0.11.0, < 1.3.4
- Fixed in
- 1.3.4
- Check
go list -m github.com/hashicorp/vault
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.
Credited to andrewpollock.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-10661
- https://github.com/hashicorp/vault/commit/18485ee9d4352ac8e8396c580b5941ccf8e5b31a
- https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#134-march-19th-2020
- https://www.hashicorp.com/blog/category/vault
- https://github.com/advisories/GHSA-j6vv-vv26-rh7c
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology