Page 4 of 25 results (0.005 seconds)

CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2022-25244

https://notcve.org/view.php?id=CVE-2022-25244

Vault Enterprise clusters using the tokenization transform feature can expose the tokenization key through the tokenization key configuration endpoint to authorized operators with `read` permissions on this endpoint. Fixed in Vault Enterprise 1.9.4, 1.8.9 and 1.7.10. Los clústeres de Vault Enterprise usando la funcionalidad tokenization transform pueden exponer la clave de tokenización mediante el endpoint de configuración de la clave de tokenización a operadores autorizados con permisos "read" en este endpoint. Corregido en Vault Enterprise versiones 1.9.4, 1.8.9 y 1.7.10 • https://discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2022-08-vault-enterprise-s-tokenization-transform-configuration-endpoint-may-expose-transform-key/36599 •

CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 0

CVE-2021-45042

https://notcve.org/view.php?id=CVE-2021-45042

In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions to a kv secrets engine) to cause a panic and denial of service of the storage backend. The earliest affected version is 1.4.0. En HashiCorp Vault y Vault Enterprise versiones anteriores a 1.7.7, 1.8.x anteriores a 1.8.6 y 1.9.x anteriores a 1.9.1, los clusters que usaban el backend de almacenamiento integrado permitían a un usuario autenticado (con permisos de escritura en un motor de secretos kv) causar un pánico y una denegación de servicio del backend de almacenamiento. La primera versión afectada es la 1.4.0 • https://discuss.hashicorp.com/t/hcsec2-21-33-vault-s-kv-secrets-engine-with-integrated-storage-exposed-to-authenticated-denial-of-service/33157 https://security.gentoo.org/glsa/202207-01 https://www.hashicorp.com/blog/category/vault •

CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0

CVE-2021-43998 – vault: incorrect policy enforcement

https://notcve.org/view.php?id=CVE-2021-43998

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0. Las políticas ACL templadas de HashiCorp Vault y Vault Enterprise 0.11.0 versiones hasta 1.7.5 y 1.8.4 siempre coincidían con el primer alias de entidad creado si presentaban varios alias de entidad para una combinación especificada de entidad y montaje, resultando potencialmente en una aplicación incorrecta de la política. Corregido en Vault y Vault Enterprise versiones 1.7.6, 1.8.5 y 1.9.0 A flaw was found in HashiCorp Vault. In affected versions of HashiCorp Vault and Vault Enterprise, templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. • https://discuss.hashicorp.com/t/hcsec-2021-30-vaults-templated-acl-policies-matched-first-created-alias-per-entity-and-auth-backend/32132 https://security.gentoo.org/glsa/202207-01 https://access.redhat.com/security/cve/CVE-2021-43998 https://bugzilla.redhat.com/show_bug.cgi?id=2028193 • CWE-732: Incorrect Permission Assignment for Critical Resource •

CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0

CVE-2021-41802

https://notcve.org/view.php?id=CVE-2021-41802

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4. HashiCorp Vault y Vault Enterprise versiones hasta 1.7.4 y 1.8.3, permitían que un usuario con permiso de escritura en un ID de alias de entidad que compartía un accesorio de montaje con otro usuario adquiriera las políticas de este otro usuario al fusionar sus identidades. Corregido en Vault y Vault Enterprise versiones 1.7.5 y 1.8.4 • https://discuss.hashicorp.com/t/hcsec-2021-27-vault-merging-multiple-entity-aliases-for-the-same-mount-may-allow-privilege-escalation https://security.gentoo.org/glsa/202207-01 • CWE-732: Incorrect Permission Assignment for Critical Resource •

CVSS: 4.4EPSS: 0%CPEs: 2EXPL: 0

CVE-2021-38553

https://notcve.org/view.php?id=CVE-2021-38553

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0. HashiCorp Vault y Vault Enterprise versiones 1.4.0 hasta 1.7.3, inicializaban un archivo de base de datos subyacente asociado con la funcionalidad Integrated Storage con permisos de sistema de archivos excesivamente amplios. Corregido en Vault y Vault Enterprise versión 1.8.0. • https://discuss.hashicorp.com/t/hcsec-2021-20-vault-s-integrated-storage-backend-database-file-may-have-excessively-broad-permissions/28168 https://security.gentoo.org/glsa/202207-01 • CWE-281: Improper Preservation of Permissions •