HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine
    plugin) did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1
    (CVE-2021-27400)

  - HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries
    without authentication. Fixed in 1.6.3. (CVE-2021-27668)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries
    without authentication. Fixed in 1.6.3. (CVE-2021-27668)

The remote host is affected by the vulnerability described in GLSA-202207-01 (HashiCorp Vault: Multiple Vulnerabilities)

  - HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via     unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7. (CVE-2020-25594)

  - HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries     without authentication. Fixed in 1.6.3. (CVE-2021-27668)

  - HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding     to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7. (CVE-2021-3024)

  - HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed     against DR secondaries without authentication. Fixed in 1.6.2. (CVE-2021-3282)

  - HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret     leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly     treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2. (CVE-2021-32923)

  - HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid     certificate signed by the same CA to access server-only functionality, enabling privilege escalation.
    Fixed in 1.8.15, 1.9.9 and 1.10.2. (CVE-2021-37219)

  - HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file     associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in     Vault and Vault Enterprise 1.8.0. (CVE-2021-38553)

  - HashiCorp Vault and Vault Enterprise's UI erroneously cached and exposed user-viewed secrets between     sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases. (CVE-2021-38554)

  - HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an     entity alias ID sharing a mount accessor with another user to acquire this other user's policies by     merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4. (CVE-2021-41802)

  - HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always     match the first-created entity alias if multiple entity aliases exist for a specified entity and mount     combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise     1.7.6, 1.8.5, and 1.9.0. (CVE-2021-43998)

  - In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters     using the Integrated Storage backend allowed an authenticated user (with write permissions to a kv secrets     engine) to cause a panic and denial of service of the storage backend. The earliest affected version is     1.4.0. (CVE-2021-45042)

  - Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain     configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI     role policy attribute allow_subdomains is set to false. Fixed in Vault Enterprise 1.8.9 and 1.9.4.
    (CVE-2022-25243)

  - HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on     login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise     1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3. (CVE-2022-30689)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

vault developers report :

Limited Unauthenticated License Read: We addressed a security vulnerability that allowed for the unauthenticated reading of Vault licenses from DR Secondaries.

ID	Name	Product	Family	Severity
407476	Alpine: vault: security update to 1.7.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407476	Alpine: vault: security update to 1.7.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
407473	Alpine: vault: security update to 1.5.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
407473	Alpine: vault: security update to 1.5.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
163698	GLSA-202207-01 : HashiCorp Vault: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
146907	FreeBSD : vault -- unauthenticated license read (52bd2d59-4ab5-4bef-a599-7aac4e92238b)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2021-27668

medium

Tenable Plugins

high

high

medium

medium

high

medium