CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-43415
https://notcve.org/view.php?id=CVE-2021-43415
03 Dec 2021 — HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1. HashiCorp Nomad y Nomad Enterprise versiones hasta 1.0.13, 1.1.7 y 1.2.0, con el controlador de tareas QEMU habilitado, permitía a usuarios autenticados con capacidad de envío de trabajos omitir las rutas de imagen permitidas configuradas. Corregido en versiones 1.0... • https://discuss.hashicorp.com/t/hcsec-2021-31-nomad-qemu-task-driver-allowed-paths-bypass-with-job-args/32288 •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43998 – vault: incorrect policy enforcement
https://notcve.org/view.php?id=CVE-2021-43998
30 Nov 2021 — HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0. Las políticas ACL templadas de HashiCorp Vault y Vault Enterprise 0.11.0 versiones hasta 1.7.5 y 1.8.4 siempre coincidían con el primer alias de entidad creado si presentaban var... • https://discuss.hashicorp.com/t/hcsec-2021-30-vaults-templated-acl-policies-matched-first-created-alias-per-entity-and-auth-backend/32132 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-42135
https://notcve.org/view.php?id=CVE-2021-42135
11 Oct 2021 — HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials. HashiCorp Vault y Vault Enterprise versiones 1.8.x a 1.8.4, pueden tener una interacción inesperada entre las políticas relacionadas con glob y el motor de secre... • https://discuss.hashicorp.com/t/hcsec-2021-28-vaults-google-cloud-secrets-engine-policies-with-globs-may-provide-additional-privileges-in-vault-1-8-0-onwards • CWE-269: Improper Privilege Management •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-41802 – Gentoo Linux Security Advisory 202207-01
https://notcve.org/view.php?id=CVE-2021-41802
08 Oct 2021 — HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4. HashiCorp Vault y Vault Enterprise versiones hasta 1.7.4 y 1.8.3, permitían que un usuario con permiso de escritura en un ID de alias de entidad que compartía un accesorio de montaje con otro usuario adquiriera las políticas de e... • https://discuss.hashicorp.com/t/hcsec-2021-27-vault-merging-multiple-entity-aliases-for-the-same-mount-may-allow-privilege-escalation • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-41865
https://notcve.org/view.php?id=CVE-2021-41865
07 Oct 2021 — HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5 allowed authenticated users with job submission capabilities to cause denial of service by submitting incomplete job specifications with a Consul mesh gateway and host networking mode. Fixed in 1.1.6. HashiCorp Nomad y Nomad Enterprise versiones 1.1.1 a 1.1.5, permitían a usuarios autenticados con capacidad de envío de trabajos causar una denegación de servicio al enviar especificaciones de trabajo incompletas con una pasarela de malla Consul y un mod... • https://discuss.hashicorp.com/t/hcsec-2021-26-nomad-denial-of-service-via-submission-of-incomplete-job-specification-using-consul-mesh-gateway-host-network/30311 •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-40862
https://notcve.org/view.php?id=CVE-2021-40862
15 Sep 2021 — HashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint that erroneously disclosed a sensitive URL to authenticated parties, which could be used for privilege escalation or unauthorized modification of a Terraform configuration. Fixed in v202109-1. HashiCorp Terraform Enterprise versiones hasta v202108-1, contenía un endpoint de la API que divulgaba erróneamente una URL confidencial a las partes autenticadas, que podía usarse para una escalada de privilegios o una modificación no autorizada... • https://discuss.hashicorp.com/t/hcsec-2021-25-terraform-enterprise-configuration-versions-api-discloses-sensitive-url/29508 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-38698 – Gentoo Linux Security Advisory 202208-09
https://notcve.org/view.php?id=CVE-2021-38698
07 Sep 2021 — HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2. El endpoint Txn.Apply de HashiCorp Consul y Consul Enterprise versión 1.10.1, permitía que los servicios registraran proxies para otros servicios, permitiendo el acceso al tráfico de los mismos. Corregido en versiones 1.8.15, 1.9.9 y 1.10.2 Multiple vulnerabilities have been discovered in HashiCorp Consul, the worst o... • https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check-on-txn-apply-endpoint/29026 • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-37218
https://notcve.org/view.php?id=CVE-2021-37218
07 Sep 2021 — HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4. La capa RPC de HashiCorp Nomad y Nomad Enterprise Raft permite a agentes no servidores con un certificado válido firmado por la misma CA acceder a la funcionalidad server-only, permitiendo una escalada de privilegios. Corregido en versiones 1.0.10 y 1.1.4 • https://discuss.hashicorp.com/t/hcsec-2021-21-nomad-raft-rpc-privilege-escalation/29023 • CWE-295: Improper Certificate Validation •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-37219 – Gentoo Linux Security Advisory 202207-01
https://notcve.org/view.php?id=CVE-2021-37219
07 Sep 2021 — HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2. La capa RPC de HashiCorp Consul y Consul Enterprise Raft versión 1.10.1 , permite a agentes que no son servidores con un certificado válido firmado por la misma CA acceder a la funcionalidad server-only, permitiendo una escalada de privilegios. Corregido en 1.8.15, 1.9.9 y 1.... • https://discuss.hashicorp.com/t/hcsec-2021-22-consul-raft-rpc-privilege-escalation/29024 • CWE-295: Improper Certificate Validation •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27668 – Gentoo Linux Security Advisory 202207-01
https://notcve.org/view.php?id=CVE-2021-27668
31 Aug 2021 — HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3. HashiCorp Vault Enterprise versiones 0.9.2 hasta 1.6.2, permitía la lectura de metadatos de licencia de DR secundarios sin autenticación. Corregido en versión 1.6.3 Multiple vulnerabilities have been discovered in HashiCorp Vault, the worst of which could result in denial of service. Versions less than 1.10.3 are affected. • https://discuss.hashicorp.com/t/hcsec-2021-05-vault-enterprise-s-dr-secondaries-exposed-license-metadata-without-authentication/21427 • CWE-306: Missing Authentication for Critical Function •