CVE-2021-42135

HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami vault

[{"type":"SEMVER","events":[{"introduced":"1.8.0"},{"fixed":"1.8.5"}]}]

Références

advisory discuss.hashicorp.com
web nvd.nist.gov