CVE-2025-3879
Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login
Résumé
Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
vault
[{"type":"SEMVER","events":[{"introduced":"0.10.0"},{"fixed":"1.19.1"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.hashicorp.com