CVE-2021-38554
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8...
Summary
Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault
Original description
The description as published by the source.
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Go
github.com/hashicorp/vault
[{"type":"SEMVER","events":[{"introduced":"1.7.0"},{"fixed":"1.7.4"}]}]
Bitnami
vault
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]
References
- advisory discuss.hashicorp.com
- advisory security.gentoo.org
- package github.com
- web nvd.nist.gov
- web github.com
- web github.com