PT-2023-26093 · Hashicorp+1 · Vault Enterprise+1

Marc Billow · Publicado 2023-09-28 · Atualizado 2024-09-26 · CVE-2023-3775

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Vault Enterprise versions prior to 1.15.0 Vault Enterprise versions prior to 1.14.4 Vault Enterprise versions prior to 1.13.8

Description A Vault Enterprise Sentinel Role Governing Policy created by an operator to restrict access to resources in one namespace can be applied to requests outside in another non-descendant namespace, potentially resulting in denial of service.

Recommendations For Vault Enterprise versions prior to 1.15.0, update to version 1.15.0 or later. For Vault Enterprise versions prior to 1.14.4, update to version 1.14.4 or later. For Vault Enterprise versions prior to 1.13.8, update to version 1.13.8 or later.

Correção

DoS

Incorrect Privilege Assignment

Enumeração de Fraquezas

CWE-266

Identificadores relacionados

ALT-PU-2024-3459

ALT-PU-2024-3678

ALT-PU-2024-4187

BIT-VAULT-2023-3775

CVE-2023-3775

Produtos afetados

Alt Linux

Vault Enterprise

Referências · 16

• https://packages.altlinux.org/ru/vuln/CVE-2023-3775 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-3775 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6337 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2024-3678 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1707537142245974383 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-3775 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4680 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2024-3459 · Aviso do Fabricante
• https://t.me/cvenotify/96256 · Publicação no Telegram
• https://discuss.hashicorp.com/t/hcsec-2023-29-vault-enterprise-s-sentinel-rgp-policies-allowed-for-cross-namespace-denial-of-service/58653 · Aviso do Fabricante
• https://t.me/cvenotify/58738 · Publicação no Telegram
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3775 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2024-4187 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-08718 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-08660 · Nota de Segurança