Skip to content
Log inStart free trial

GHSA-rpgp-9hmg-j25x BIT-vault-2020-35177 CVE-2020-35177 GO-2024-2508

Enumeration of users in HashiCorp Vault

Medium Go
Severity
6.5 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
1.22%
Chance of exploitation in the next 30 days. Higher than 68.64% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Fix
1.5.6
Upgrade github.com/hashicorp/vault to this version or later

Description

HashiCorp Vault and Vault Enterprise allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

Affected versions

Go

PackageVulnerableFixed in
github.com/hashicorp/vault
>= 1.5.0, < 1.5.6
1.5.6
github.com/hashicorp/vault
>= 1.6.0, < 1.6.1
1.6.1
github.com/hashicorp/vault
>= 1.5.0, < 1.5.6
>= 1.6.0, < 1.6.1
1.5.6
1.6.1

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/hashicorp/vault Go → 1.5.6

go
go get github.com/hashicorp/vault@v1.5.6 && go mod tidy

Severity breakdown

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:R

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Exploit maturity
Unreported

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it
  • Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Advisories

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-88v5-9hxc-f85r
HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations
High Also affects github.com/hashicorp/vault
GHSA-8r5m-3f66-qpr3
HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
High Also affects github.com/hashicorp/vault
GHSA-72gw-fmmr-c4r4
HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization
High Also affects github.com/hashicorp/vault
GHSA-m2w4-8ggf-rj47
HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service
High Also affects github.com/hashicorp/vault
GHSA-vp5w-xcfc-73wf
Hashicorp Vault and Vault Enterprise vulnerable to a denial of service when processing JSON
High Also affects github.com/hashicorp/vault
GHSA-9g4h-h484-3578
HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass
High Also affects github.com/hashicorp/vault
GHSA-8f82-53h8-2p34
HashiCorp Vault Community Edition Denial of Service Though Complex JSON Payloads
High Also affects github.com/hashicorp/vault
GHSA-7rx2-769v-hrwf
HashiCorp Vault ldap auth method may not have correctly enforced MFA
High Also affects github.com/hashicorp/vault
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor