CVE-2021-38554
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8...
Résumé
Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault
Description d'origine
La description telle que publiée par la source (souvent en anglais).
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Go
github.com/hashicorp/vault
[{"type":"SEMVER","events":[{"introduced":"1.7.0"},{"fixed":"1.7.4"}]}]
Bitnami
vault
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]
Références
- advisory discuss.hashicorp.com
- advisory security.gentoo.org
- package github.com
- web nvd.nist.gov
- web github.com
- web github.com