CVE-2021-3282

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication....

Original description

The description as published by the source.

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami vault

[{"type":"SEMVER","events":[{"introduced":"1.6.0"},{"fixed":"1.6.1"},{"introduced":"1.6.1"},{"fixed":"1.6.2"}]}]

References

advisory discuss.hashicorp.com
advisory security.gentoo.org
web nvd.nist.gov