CVE-2021-42135: Incorrect Privilege Assignment in HashiCorp Vault
Summary
CVE-2021-42135: Incorrect Privilege Assignment in HashiCorp Vault. Affects github.com/hashicorp/vault versions >= 1.8.0, <= 1.8.4. No fix is published. How to fix ↓
Also tracked for
- vault · Bitnami
The same CVE-2021-42135 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Vault is a popular open-source tool used for securely storing and accessing secrets, such as API keys, passwords, and certificates. It provides a centralized solution for managing secrets across different applications and environments. Vault is written in Go and is widely adopted in various industries. However, versions 1.8.x through 1.8.4 of HashiCorp Vault and Vault Enterprise have a vulnerability that can lead to incorrect privilege assignment.
Vulnerability Detail
The vulnerability in HashiCorp Vault arises from an unexpected interaction between glob-related policies and the Google Cloud secrets engine. In certain situations, users may have more privileges than intended. For example, a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials. This can result in unauthorized access to sensitive resources and potential misuse of privileged actions. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a non-affected version of HashiCorp Vault.
Conclusion
The vulnerability in HashiCorp Vault can result in incorrect privilege assignment and potential unauthorized access to sensitive resources. It is crucial to upgrade to a non-affected version of HashiCorp Vault to mitigate this risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for github.com/hashicorp/vault →
FAQ
HashiCorp Vault is an open-source tool used for securely storing and accessing secrets.
The vulnerability can lead to incorrect privilege assignment, potentially allowing unauthorized access to sensitive resources.
You can use the Vulert playground at Vulert Scanner to check if your version of HashiCorp Vault is affected by this vulnerability.
No, there are no known workarounds for this vulnerability. It is crucial to upgrade to a non-affected version of HashiCorp Vault.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/vault.
