PT-2018-15092 · Hashicorp · Hashicorp Vault

Publicado 2018-12-05 · Atualizado 2018-12-27 · CVE-2018-19786

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Vault versions prior to 1.0.0

Description The issue arises in certain unusual or misconfigured scenarios where incorrect data comes from the autoseal mechanism without an error being reported, causing the master key to be written to the server log.

Recommendations For versions prior to 1.0.0, update to version 1.0.0 or later to resolve the issue.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2018-19786

Produtos afetados

Hashicorp Vault

Referências · 3

• https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#100-december-3rd-2018 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-19786 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-19786 · Aviso do Fabricante