critical9.1
CVE-2020-10661
HashiCorp Vault Improper Privilege Management
Impact
HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/hashicorp/vault | >= 0.11.0, < 1.3.4 | 1.3.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Vault | from 0.11.0 through 1.3.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#134-march-19th-2020
- https://www.hashicorp.com/blog/category/vault/
- https://github.com/advisories/GHSA-j6vv-vv26-rh7c
- https://nvd.nist.gov/vuln/detail/CVE-2020-10661
- https://github.com/hashicorp/vault/commit/18485ee9d4352ac8e8396c580b5941ccf8e5b31a
- https://www.hashicorp.com/blog/category/vault