PT-2022-17175 · Hashicorp · Vault Enterprise

Published 2022-03-07 · Updated 2024-03-06 · CVE-2022-25244

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vault Enterprise versions prior to 1.7.10 Vault Enterprise versions prior to 1.8.9 Vault Enterprise versions prior to 1.9.4

Description The issue affects Vault Enterprise clusters that use the tokenization transform feature, potentially exposing the tokenization key through the tokenization key configuration endpoint to authorized operators with read permissions.

Recommendations For Vault Enterprise versions prior to 1.7.10, update to version 1.7.10 or later. For Vault Enterprise versions prior to 1.8.9, update to version 1.8.9 or later. For Vault Enterprise versions prior to 1.9.4, update to version 1.9.4 or later.

Fix

Related Identifiers

BIT-VAULT-2022-25244

CVE-2022-25244

Affected Products

Vault Enterprise

References · 6

• https://osv.dev/vulnerability/BIT-vault-2022-25244 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25244 · Vendor Advisory
• https://discuss.hashicorp.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25244 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2022-08-vault-enterprise-s-tokenization-transform-configuration-endpoint-may-expose-transform-key/36599 · Vendor Advisory
• https://t.me/cibsecurity/38681 · Telegram Post