PT-2021-19974 · Hashicorp · Vault Enterprise+1

Published 2021-06-03 · Updated 2024-08-21 · CVE-2021-32923

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault and Vault Enterprise versions prior to 1.5.9 HashiCorp Vault and Vault Enterprise versions prior to 1.6.5 HashiCorp Vault and Vault Enterprise versions prior to 1.7.2

Description The issue allowed the renewal of nearly-expired token leases and dynamic secret leases, specifically those within 1 second of their maximum TTL, causing them to be incorrectly treated as non-expiring during subsequent use.

Recommendations For versions prior to 1.5.9, update to version 1.5.9 or later. For versions prior to 1.6.5, update to version 1.6.5 or later. For versions prior to 1.7.2, update to version 1.7.2 or later.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BIT-VAULT-2021-32923

CVE-2021-32923

GHSA-38J9-7PP9-2HJW

GO-2022-0623

Affected Products

Hashicorp Vault

Vault Enterprise

References · 11

• https://osv.dev/vulnerability/GO-2022-0623 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32923 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2021-15-vault-renewed-nearly-expired-leases-with-incorrect-non-expiring-ttls/24603 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2021-32923 · Vendor Advisory
• https://hashicorp.com/blog/category/vault · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32923 · Vendor Advisory
• https://security.gentoo.org/glsa/202207-01 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-38j9-7pp9-2hjw · Vendor Advisory
• https://t.me/cvenotify/34123 · Telegram Post
• https://github.com/advisories/GHSA-38j9-7pp9-2hjw · Note
• https://t.me/cvenotify/16453 · Telegram Post