PT-2022-23215 · Hashicorp · Hashicorp Vault Enterprise

Published 2022-07-26 · Updated 2024-03-06 · CVE-2022-36129

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Vault Enterprise versions 1.7.0 through 1.9.7 HashiCorp Vault Enterprise version 1.10.4 HashiCorp Vault Enterprise version 1.11.0

Description The issue concerns an unauthenticated API endpoint in HashiCorp Vault Enterprise that could be exploited to override the voter status of a node within a Vault HA cluster. This could lead to potential data loss or catastrophic failure.

Recommendations For HashiCorp Vault Enterprise versions 1.7.0 through 1.9.7, update to version 1.9.8 or later. For HashiCorp Vault Enterprise version 1.10.4, update to version 1.10.5 or later. For HashiCorp Vault Enterprise version 1.11.0, update to version 1.11.1 or later.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BIT-VAULT-2022-36129

CVE-2022-36129

Affected Products

Hashicorp Vault Enterprise

References · 7

• https://osv.dev/vulnerability/CVE-2022-36129 · Vendor Advisory
• https://discuss.hashicorp.com · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36129 · Security Note
• https://osv.dev/vulnerability/BIT-vault-2022-36129 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220901-0011 · Note
• https://t.me/cibsecurity/47053 · Telegram Post