Filtered by vendor Hashicorp
Subscribe
Total
167 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-3867 | 1 Hashicorp | 1 Nomad | 2022-11-15 | N/A | 4.3 MEDIUM |
| HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2. | |||||
| CVE-2022-3866 | 1 Hashicorp | 1 Nomad | 2022-11-15 | N/A | 4.3 MEDIUM |
| HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2. | |||||
| CVE-2022-25243 | 1 Hashicorp | 1 Vault | 2022-11-09 | 3.5 LOW | 6.5 MEDIUM |
| "Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allow_subdomains is set to false. Fixed in Vault Enterprise 1.8.9 and 1.9.4. | |||||
| CVE-2021-38553 | 1 Hashicorp | 1 Vault | 2022-10-25 | 2.1 LOW | 4.4 MEDIUM |
| HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0. | |||||
| CVE-2021-32923 | 1 Hashicorp | 1 Vault | 2022-10-25 | 5.8 MEDIUM | 7.4 HIGH |
| HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2. | |||||
| CVE-2021-3282 | 1 Hashicorp | 1 Vault | 2022-10-25 | 5.0 MEDIUM | 7.5 HIGH |
| HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2. | |||||
| CVE-2021-28156 | 1 Hashicorp | 1 Consul | 2022-10-25 | 5.0 MEDIUM | 7.5 HIGH |
| HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10. | |||||
| CVE-2020-25201 | 1 Hashicorp | 1 Consul | 2022-10-25 | 5.0 MEDIUM | 7.5 HIGH |
| HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5. | |||||
| CVE-2020-28053 | 1 Hashicorp | 1 Consul | 2022-10-25 | 4.0 MEDIUM | 6.5 MEDIUM |
| HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6. | |||||
| CVE-2020-25864 | 1 Hashicorp | 1 Consul | 2022-10-25 | 4.3 MEDIUM | 6.1 MEDIUM |
| HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14. | |||||
| CVE-2021-32574 | 1 Hashicorp | 1 Consul | 2022-10-25 | 5.0 MEDIUM | 7.5 HIGH |
| HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1. | |||||
| CVE-2022-29810 | 1 Hashicorp | 1 Go-getter | 2022-10-06 | 2.1 LOW | 5.5 MEDIUM |
| The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter. | |||||
| CVE-2021-38698 | 1 Hashicorp | 1 Consul | 2022-09-14 | 4.0 MEDIUM | 6.5 MEDIUM |
| HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2. | |||||
| CVE-2021-36213 | 1 Hashicorp | 1 Consul | 2022-09-14 | 5.0 MEDIUM | 7.5 HIGH |
| HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1. | |||||
| CVE-2020-25594 | 1 Hashicorp | 1 Vault | 2022-09-14 | 5.0 MEDIUM | 5.3 MEDIUM |
| HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7. | |||||
| CVE-2021-3024 | 1 Hashicorp | 1 Vault | 2022-09-14 | 5.0 MEDIUM | 5.3 MEDIUM |
| HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7. | |||||
| CVE-2022-36130 | 1 Hashicorp | 1 Boundary | 2022-09-09 | N/A | 9.9 CRITICAL |
| HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2. | |||||
| CVE-2021-41802 | 1 Hashicorp | 1 Vault | 2022-09-08 | 5.5 MEDIUM | 5.4 MEDIUM |
| HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4. | |||||
| CVE-2021-27668 | 1 Hashicorp | 1 Vault | 2022-09-08 | 5.0 MEDIUM | 5.3 MEDIUM |
| HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3. | |||||
| CVE-2021-37219 | 1 Hashicorp | 1 Consul | 2022-09-08 | 6.5 MEDIUM | 8.8 HIGH |
| HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2. | |||||