PT-2022-25812 · Hashicorp+1 · Vault Enterprise+2

Published 2022-10-11 · Updated 2025-05-26 · CVE-2022-41316

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault and Vault Enterprise versions prior to 1.12.0 HashiCorp Vault and Vault Enterprise versions prior to 1.11.4 HashiCorp Vault and Vault Enterprise versions prior to 1.10.7 HashiCorp Vault and Vault Enterprise versions prior to 1.9.10

Description The TLS certificate auth method in HashiCorp Vault and Vault Enterprise did not initially load the optionally configured CRL issued by the role's CA into memory on startup. This resulted in the revocation list not being checked if the CRL has not yet been retrieved.

Recommendations For versions prior to 1.12.0, update to version 1.12.0 or later. For versions prior to 1.11.4, update to version 1.11.4 or later. For versions prior to 1.10.7, update to version 1.10.7 or later. For versions prior to 1.9.10, update to version 1.9.10 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2025-06184

BIT-VAULT-2022-41316

CVE-2022-41316

GHSA-9MH8-9J64-443F

GO-2023-1897

Affected Products

Hashicorp Vault

Red Os

Vault Enterprise

References · 15

• https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06184 · Security Note
• https://osv.dev/vulnerability/GO-2023-1897 · Vendor Advisory
• https://discuss.hashicorp.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41316 · Security Note
• https://osv.dev/vulnerability/BIT-vault-2022-41316 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41316 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9mh8-9j64-443f · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://redos.red-soft.ru/support/secure · Note
• https://security.netapp.com/advisory/ntap-20221201-0001 · Note
• https://github.com/advisories/GHSA-9mh8-9j64-443f · Note
• https://t.me/cvenotify/39069 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-vault-260525 · Note
• https://access.redhat.com/security/cve/cve-2022-41316 · Note