PT-2021-24194 · Hashicorp · Vault Enterprise+1

Published 2021-12-17 · Updated 2024-03-06 · CVE-2021-45042

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions 1.4.0 through 1.7.6 HashiCorp Vault and Vault Enterprise versions 1.8.0 through 1.8.5 HashiCorp Vault and Vault Enterprise versions 1.9.0

Description: The issue allows an authenticated user with write permissions to a kv secrets engine to cause a panic and denial of service of the storage backend in clusters using the Integrated Storage backend.

Recommendations: For versions 1.4.0 through 1.7.6, update to version 1.7.7 or later. For versions 1.8.0 through 1.8.5, update to version 1.8.6 or later. For version 1.9.0, update to version 1.9.1 or later.

Fix

Related Identifiers

BIT-VAULT-2021-45042

CVE-2021-45042

Affected Products

Hashicorp Vault

Vault Enterprise

References · 7

• https://osv.dev/vulnerability/BIT-vault-2021-45042 · Vendor Advisory
• https://hashicorp.com/blog/category/vault · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45042 · Vendor Advisory
• https://security.gentoo.org/glsa/202207-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45042 · Security Note
• https://discuss.hashicorp.com/t/hcsec2-21-33-vault-s-kv-secrets-engine-with-integrated-storage-exposed-to-authenticated-denial-of-service/33157 · Vendor Advisory
• https://t.me/cibsecurity/34187 · Telegram Post