PT-2021-19953 · Hashicorp · Hashicorp Vault Enterprise

Published 2021-02-01 · Updated 2024-06-28 · CVE-2021-3282

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault Enterprise versions 1.6.0 through 1.6.1

Description The issue allows the remove-peer raft operator command to be executed against DR secondaries without authentication. This affects HashiCorp Vault Enterprise.

Recommendations For versions 1.6.0 and 1.6.1, update to version 1.6.2 to resolve the issue. As a temporary workaround, consider restricting access to the remove-peer command until the update is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BIT-VAULT-2021-3282

CVE-2021-3282

GHSA-RQ95-XF66-J689

GO-2024-2509

Affected Products

Hashicorp Vault Enterprise

References · 12

• https://osv.dev/vulnerability/GO-2024-2509 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2021-04-vault-enterprise-s-dr-secondaries-allowed-raft-peer-removal-without-authentication/20337 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rq95-xf66-j689 · Vendor Advisory
• https://security.gentoo.org/glsa/202207-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3282 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3282 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2021-3282 · Vendor Advisory
• https://github.com/hashicorp/vault/commit/09f9068e22f762da123160233518b440e00bdb3b · Note
• https://t.me/cvenotify/34121 · Telegram Post
• https://t.me/cvenotify/9412 · Telegram Post
• https://t.me/cibsecurity/22894 · Telegram Post
• https://github.com/advisories/GHSA-rq95-xf66-j689 · Note