CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-6468 – Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior
https://notcve.org/view.php?id=CVE-2024-6468
Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxy_protocol_behavior, was set to deny_unauthorized. When receiving a request from a source IP address that was not listed in proxy_protocol_authorized_addrs, the Vault API server would shut down and no longer respond to any HTTP requests, potentially resulting in denial of service. While this bug also affected versions of Vault up to 1.17.1 and 1.16.5, a separate regression in those release series did not allow Vault operators to configure the deny_unauthorized option, thus not allowing the conditions for the denial of service to occur. Fixed in Vault and Vault Enterprise 1.17.2, 1.16.6, and 1.15.12. Vault y Vault Enterprise no manejaron adecuadamente las solicitudes originadas en direcciones IP no autorizadas cuando la opción de escucha TCP, proxy_protocol_behavior, estaba configurada en deny_unauthorized. Al recibir una solicitud de una dirección IP de origen que no figuraba en proxy_protocol_authorized_addrs, el servidor API de Vault se cerraba y ya no respondía a ninguna solicitud HTTP, lo que podría provocar una denegación de servicio. Si bien este error también afectó a las versiones de Vault hasta 1.17.1 y 1.16.5, una regresión separada en esas series de versiones no permitió a los operadores de Vault configurar la opción deny_unauthorized, por lo que no permitió que se cumplieran las condiciones para la denegación de servicio. • https://discuss.hashicorp.com/t/hcsec-2024-14-vault-vulnerable-to-denial-of-service-when-setting-a-proxy-protocol-behavior/68518 • CWE-703: Improper Check or Handling of Exceptional Conditions •
CVSS: 2.6EPSS: 0%CPEs: 2EXPL: 0CVE-2024-5798 – Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims
https://notcve.org/view.php?id=CVE-2024-5798
Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9 Vault y Vault Enterprise no validaron correctamente la reclamación de audiencia vinculada a roles JSON Web Token (JWT) al utilizar el método de autenticación Vault JWT. Esto puede haber provocado que Vault valide un JWT en el que las afirmaciones de audiencia y roles no coinciden, lo que permitió que un inicio de sesión no válido se realizara correctamente cuando debería haber sido rechazado. Esta vulnerabilidad, CVE-2024-5798, se solucionó en Vault y Vault Enterprise 1.17.0, 1.16.3 y 1.15.9. • https://discuss.hashicorp.com/t/hcsec-2024-11-vault-incorrectly-validated-json-web-tokens-jwt-audience-claims/67770 • CWE-285: Improper Authorization •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2023-6337 – Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests
https://notcve.org/view.php?id=CVE-2023-6337
HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash. Fixed in Vault 1.15.4, 1.14.8, 1.13.12. HashiCorp Vault y Vault Enterprise 1.12.0 y versiones posteriores son vulnerables a una denegación de servicio debido al agotamiento de la memoria del host cuando se manejan grandes solicitudes HTTP autenticadas y no autenticadas de un cliente. Vault intentará asignar la solicitud a la memoria, lo que provocará que se agote la memoria disponible en el host, lo que puede provocar que Vault falle. Corregido en Vault 1.15.4, 1.14.8, 1.13.12. • https://discuss.hashicorp.com/t/hcsec-2023-34-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-handling-large-http-requests/60741 https://security.netapp.com/advisory/ntap-20240112-0006 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.6EPSS: 0%CPEs: 2EXPL: 0CVE-2023-5077 – Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets
https://notcve.org/view.php?id=CVE-2023-5077
The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0. El engine de los secretos en Vault and Vault Enterprise ("Vault") Google Cloud no conservó la existencia de Google Cloud IAM Conditions al crear o actualizar conjuntos de roles. Corregido en Vault 1.13.0. A flaw was found in HashiCorp Vault and Vault Enterprise. • https://discuss.hashicorp.com/t/hcsec-2023-30-vault-s-google-cloud-secrets-engine-removed-existing-iam-conditions-when-creating-updating-rolesets/58654 https://access.redhat.com/security/cve/CVE-2023-5077 https://bugzilla.redhat.com/show_bug.cgi?id=2241980 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 0CVE-2023-3775 – Vault Enterprise's Sentinel RGP Policies Allowed For Cross-Namespace Denial of Service
https://notcve.org/view.php?id=CVE-2023-3775
A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potentially resulting in denial of service. Fixed in Vault Enterprise 1.15.0, 1.14.4, 1.13.8. Vault Enterprise Sentinel Role Governing Policy creada por un operador para restringir el acceso a los recursos en un espacio de nombres se puede aplicar a solicitudes externas en otro espacio de nombres no descendiente, lo que podría provocar una denegación de servicio. Corregido en Vault Enterprise 1.15.0, 1.14.4, 1.13.8. • https://discuss.hashicorp.com/t/hcsec-2023-29-vault-enterprise-s-sentinel-rgp-policies-allowed-for-cross-namespace-denial-of-service/58653 • CWE-20: Improper Input Validation •