Cipherboy

**Name of the Vulnerable Software and Affected Versions** OpenBao versions prior to 2.5.3 **Description** An issue exists in the identity-based secrets management system where an initial failure during namespace deletion causes subsequent retries to fail to remove all data before the namespace is marked as deleted. This may result in outstanding leases remaining active or unrelated storage entries being left behind. **Recommendations** Update to version 2.5.3. Manually remove mounts prior to deleting the namespace. Use audit logs to identify repeated deletion attempts against the same namespace and utilize `sys/raw` to identify leases that were not correctly deleted.

**Name of the Vulnerable Software and Affected Versions** OpenBao versions 2.3.1 and below **Description** OpenBao is a software solution for managing, storing, and distributing sensitive data. In affected versions, accounts with access to highly-privileged identity entity systems in root namespaces could increase their scope directly to the root policy. The identity system allowed adding arbitrary policies with capability grants on arbitrary paths, but the root policy was restricted to manual generation. The global root policy was not accessible from child namespaces. **Recommendations** OpenBao versions prior to 2.3.2: Upgrade to version 2.3.2 or later to resolve this issue. As a temporary workaround, use of `denied parameters` in any policy which has access to the affected identity endpoints (on `identity entities`) may be sufficient to prohibit this type of attack.

**Name of the Vulnerable Software and Affected Versions** OpenBao versions 0.1.0 through 2.3.1 **Description** Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP authentication systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. **Recommendations** Update to version 2.3.2 to resolve this issue. Apply rate-limiting quotas on the authentication endpoints.

**Name of the Vulnerable Software and Affected Versions** OpenBao versions 0.1.0 through 2.3.1 **Description** OpenBao is a software solution designed for managing, storing, and distributing sensitive data, including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, user enumeration was possible when using the userpass authentication method due to timing differences between non-existent users and users with stored credentials. This issue occurred regardless of the validity of the supplied credentials. **Recommendations** OpenBao version 2.3.2 and later resolves this issue. As a workaround, use an alternative authentication method. Apply rate limiting quotas to limit the number of requests within a specific timeframe.

**Name of the Vulnerable Software and Affected Versions** OpenBao versions 0.1.0 through 2.3.1 **Description** OpenBao’s TOTP secrets engine could accept valid Time-based One-Time Password (TOTP) codes multiple times instead of strictly once. This issue stemmed from unexpected normalization within the underlying TOTP library. TOTP code verification is a privileged action and should only be performed by trusted systems. **Recommendations** Versions prior to 2.3.2 are affected. Ensure all codes are normalized before submitting to the OpenBao endpoint.

**Name of the Vulnerable Software and Affected Versions** OpenBao versions 2.3.1 and below **Description** OpenBao allows the assignment of policies and MFA attribution based on entity aliases. When the `username as alias=true` parameter in the LDAP auth method is used, the supplied username is used without normalization, potentially allowing an attacker to bypass alias-specific MFA requirements. **Recommendations** OpenBao versions prior to 2.3.2: Remove all usage of the `username as alias=true` parameter and update any entity aliases accordingly.

**Name of the Vulnerable Software and Affected Versions** OpenBao versions 2.3.1 and below **Description** OpenBao’s Login Multi-Factor Authentication (MFA) system, utilizing Time-based One Time Password (TOTP), accepted codes containing whitespace due to normalization applied by the underlying TOTP library. This bypassed internal rate limiting, allowing reuse of existing MFA codes. **Recommendations** Upgrade to version 2.3.2 to resolve this issue. Utilize rate-limiting quotas to limit potential exploitation.

Name of the Vulnerable Software and Affected Versions: OpenBao versions prior to 2.3.0 Description: OpenBao is a software solution for managing, storing, and distributing sensitive data, including secrets, certificates, and keys. The issue allows an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, resulting in a denial of service. Recommendations: For OpenBao versions prior to 2.3.0, manually set the configuration option `disable unauthed rekey endpoints=true` to deny these endpoints on global listeners. As a temporary workaround, if an active proxy or load balancer sits in front of OpenBao, consider denying requests to these endpoints from unauthorized IP ranges. Update to version 2.3.0 or later, where the issue is resolved.

Name of the Vulnerable Software and Affected Versions: OpenBao versions prior to 2.3.0 Description: The issue concerns the potential leak of sensitive information in logs when processing malformed data. This problem has been identified in OpenBao, a software solution designed to manage, store, and distribute sensitive data, including secrets, certificates, and keys. There are no known real-world incidents or estimated numbers of affected devices mentioned. Recommendations: For versions prior to 2.3.0, update to version 2.3.0 or later to resolve the issue. As a temporary workaround, ensure properly formatted requests from all clients to minimize the risk of sensitive information leakage.

Name of the Vulnerable Software and Affected Versions: MonicaHQ version 4.1.1 Description: The issue allows attackers to exploit authenticated client-side injection in journal entry edits, with a medium severity level. A patch is pending, and users should monitor updates closely. Recommendations: For version 4.1.1, update to a newer version once the pending patch is released to resolve the issue. As a temporary workaround, consider restricting access to journal entry edits until the patch is available.