CVE-2021-32923: HashiCorp Vault Token Lease Renewal Vulnerability
Summary
CVE-2021-32923: HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as... Affects vault across 3 version ranges.
>= 0.10.0, < 1.5.9
>= 1.6.0, < 1.6.5
>= 1.7.0, < 1.7.2
Fixed in 1.5.9, 1.6.5 or 1.7.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-32923 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Vault is an open-source tool designed for securely storing and accessing secrets. It provides a centralized solution for managing sensitive information such as API keys, passwords, and certificates. Vault offers features like dynamic secrets, token-based authentication, and fine-grained access control. However, a vulnerability has been identified in Vault versions prior to 1.5.9, 1.6.5, and 1.7.2, which allows the renewal of nearly-expired token leases and dynamic secret leases within 1 second of their maximum TTL. This issue causes these leases to be incorrectly treated as non-expiring during subsequent use.
Vulnerability Detail
The vulnerability in HashiCorp Vault and Vault Enterprise allows the renewal of token leases and dynamic secret leases that are almost expired. When a lease is renewed within 1 second of its maximum TTL, it is incorrectly treated as non-expiring. This can lead to unexpected behavior and security risks. An attacker could exploit this vulnerability to extend the validity of a token or secret lease, potentially bypassing security measures or gaining unauthorized access to sensitive information. The issue has been fixed in versions 1.5.9, 1.6.5, and 1.7.2 of Vault.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.10.0, < 1.5.91.5.9 -
>= 1.6.0, < 1.6.51.6.5 -
>= 1.7.0, < 1.7.21.7.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions of HashiCorp Vault to mitigate the risk.
Conclusion
The HashiCorp Vault Token Lease Renewal Vulnerability allows the renewal of nearly-expired token leases and dynamic secret leases, incorrectly treating them as non-expiring. This can lead to unexpected behavior and potential security risks. It is crucial to upgrade to the fixed versions (1.5.9, 1.6.5, or 1.7.2) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vault →
FAQ
HashiCorp Vault is an open-source tool for securely storing and accessing secrets, such as API keys, passwords, and certificates. It provides a centralized solution for managing sensitive information.
The vulnerability allows the renewal of nearly-expired token leases and dynamic secret leases, incorrectly treating them as non-expiring. This can lead to unexpected behavior and potential security risks, such as unauthorized access to sensitive information.
Versions of HashiCorp Vault prior to 1.5.9, 1.6.5, and 1.7.2 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to the latest version of HashiCorp Vault (1.5.9, 1.6.5, or 1.7.2) that includes the necessary patches.
No, there is no known workaround for this vulnerability. Upgrading to the fixed versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for vault.
