CVE-2025-3879
Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login
概要
Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
vault
[{"type":"SEMVER","events":[{"introduced":"0.10.0"},{"fixed":"1.19.1"}]}]
参照URL
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.hashicorp.com