medium5.3
CVE-2021-3024
HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests.
Impact
HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Vault | before 1.5.7 from 1.6.0 before 1.6.2 |
References
- NVD record
- CVE.org record
- https://discuss.hashicorp.com/t/hcsec-2021-02-vault-api-endpoint-exposed-internal-ip-address-without-authentication/20334
- https://security.gentoo.org/glsa/202207-01
- https://discuss.hashicorp.com/t/hcsec-2021-02-vault-api-endpoint-exposed-internal-ip-address-without-authentication/20334
- https://security.gentoo.org/glsa/202207-01