CVE-2020-25816: HashiCorp Vault Lease Expiration Time Scheduling Vulnerability
Summary
CVE-2020-25816: HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Affects vault across 2 version ranges.
>= 1.0.0, < 1.4.7
>= 1.5.0, < 1.5.4
Fixed in 1.4.7 or 1.5.4, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-25816 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Vault is an open-source tool designed to securely store and manage secrets, such as API keys, passwords, and certificates. It provides a centralized solution for access control and encryption of sensitive data. Vault Enterprise is the commercial version of Vault, offering additional features and support. This vulnerability affects versions 1.0 and newer of both Vault and Vault Enterprise.
Vulnerability Detail
The vulnerability in HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL (Time To Live) due to incorrect expiration time scheduling. This means that leases could persist beyond their intended expiration time, potentially leading to unauthorized access and exposure of sensitive information. The issue has been addressed in versions 1.4.7 and 1.5.4 of Vault and Vault Enterprise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.4.71.4.7 -
>= 1.5.0, < 1.5.41.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the official patches provided by HashiCorp to address the issue.
Conclusion
The HashiCorp Vault Lease Expiration Time Scheduling Vulnerability (CVE-2020-25816) affects versions 1.0 and newer of HashiCorp Vault and Vault Enterprise. It allows leases created with a batch token to outlive their TTL, potentially leading to unauthorized access and exposure of sensitive information. To mitigate this risk, it is crucial to upgrade to the latest patched versions (1.4.7 or 1.5.4) and follow the official upgrade instructions provided by HashiCorp. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for vault →
FAQ
HashiCorp Vault is an open-source tool for securely storing and managing secrets, such as API keys, passwords, and certificates. It provides a centralized solution for access control and encryption of sensitive data.
Versions 1.0 and newer of both HashiCorp Vault and Vault Enterprise are affected by this vulnerability.
This vulnerability could allow leases created with a batch token to persist beyond their intended expiration time, potentially leading to unauthorized access and exposure of sensitive information.
To fix this vulnerability, it is recommended to upgrade to the latest patched versions of HashiCorp Vault or Vault Enterprise (1.4.7 or 1.5.4). Follow the official upgrade instructions provided by HashiCorp.
No, there is no known workaround for this vulnerability. Applying the official patches is necessary to address the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for vault.
