Lucene search

GitHub Advisory DatabaseGHSA-HWC3-3QH6-R4GG

HistoryMar 30, 2023 - 3:30 a.m.

HashiCorp Vault's PKI mount vulnerable to denial of service

2023-03-3003:30:38

CWE-285

GitHub Advisory Database

github.com

hashicorp vault

pki

denial of service

vulnerability

endpoint

bug

fix

software security

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS

0.001

Percentile

37.4%

JSON

HashiCorp Vault’s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

Affected configurations

Vulners

Node

hashicorpvaultRange1.13.0–1.13.1

hashicorpvaultRange1.12.0–1.12.5

hashicorpvaultRange<1.11.9

VendorProductVersionCPE
hashicorpvault*cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hashicorp	vault	*	cpe:2.3:a:hashicorp:vault::::::::

References

discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1

github.com/advisories/GHSA-hwc3-3qh6-r4gg

nvd.nist.gov/vuln/detail/CVE-2023-0665

security.netapp.com/advisory/ntap-20230526-0008/

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS

0.001

Percentile

37.4%

JSON

Related for GHSA-HWC3-3QH6-R4GG