CVE-2025-6013
Vault LDAP MFA Enforcement Bypass When Using Username As Alias
Résumé
Vault LDAP MFA Enforcement Bypass When Using Username As Alias
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
vault
[{"type":"SEMVER","events":[{"introduced":"1.10.0"},{"fixed":"1.20.2"}]}]
Références
- advisory discuss.hashicorp.com
- web nvd.nist.gov