PT-2021-24000 · Hashicorp · Vault Enterprise+1

Christian Baumann + 1 · Published 2021-11-30 · Updated 2024-08-21 · CVE-2021-43998

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.7.5 HashiCorp Vault and Vault Enterprise version 1.8.4

Description: The issue arises when templated ACL policies in HashiCorp Vault and Vault Enterprise match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination. This can lead to incorrect policy enforcement.

Recommendations: For HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.7.5, update to version 1.7.6 or later. For HashiCorp Vault and Vault Enterprise version 1.8.4, update to version 1.8.5 or later. As a general mitigation measure, consider reviewing and adjusting templated ACL policies to ensure correct entity alias matching until the issue is resolved.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BIT-VAULT-2021-43998

CVE-2021-43998

GHSA-PFMW-VJ74-PH8G

GO-2022-0611

Affected Products

Hashicorp Vault

Vault Enterprise

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2021-43998 · Security Note
• https://osv.dev/vulnerability/BIT-vault-2021-43998 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2021-30-vaults-templated-acl-policies-matched-first-created-alias-per-entity-and-auth-backend/32132 · Vendor Advisory
• https://security.gentoo.org/glsa/202207-01 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pfmw-vj74-ph8g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43998 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0611 · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://t.me/cibsecurity/33095 · Telegram Post
• https://github.com/advisories/GHSA-pfmw-vj74-ph8g · Note