HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally
    configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being
    checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.
    (CVE-2022-41316)

ID	Name	Product	Family	Type	Severity
413369	SCA: security update for github.com/hashicorp/vault (GHSA-9mh8-9j64-443f)	Tenable Cloud Security	SCA Checks	Local	medium
413369	SCA: security update for github.com/hashicorp/vault (GHSA-9mh8-9j64-443f)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
407466	Alpine: vault: security update to 1.11.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
407466	Alpine: vault: security update to 1.11.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium
407465	Alpine: vault: security update to 1.10.7-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	medium
407465	Alpine: vault: security update to 1.10.7-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	medium

Detections

Analytics

CVE-2022-41316

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium