Denial of service

2020-12-1705:15:00

PRIOn knowledge base

www.prio-n.com

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.9%

JSON

HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. Fixed in 1.5.6 and 1.6.1.

CPENameOperatorVersion
vaultge1.6.0
vaultlt1.6.1
vaultge1.5.0
vaultlt1.5.6
vaultge1.6.0
vaultlt1.6.1
vaultge1.5.0
vaultlt1.5.6

Name	Operator	Version
vault	ge	1.6.0
vault	lt	1.6.1
vault	ge	1.5.0
vault	lt	1.5.6
vault	ge	1.6.0
vault	lt	1.6.1
vault	ge	1.5.0
vault	lt	1.5.6

References

discuss.hashicorp.com/t/hcsec-2020-24-vault-enterprise-s-sentinel-egp-policies-may-impact-parent-or-sibling-namespaces/18983

github.com/hashicorp/vault/blob/master/CHANGELOG.md