Vulnerability · Published Sep 30, 2020 · Assigned by mitre
CVE-2020-25816
Medium 6.8
In plain English
A medium-severity security flaw in the github.com/hashicorp/vault package (Go). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.8Medium
Exploit odds (30 days)1.0%top 36.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hashicorp/vault | 1.5.4 | GHSA-57gg-cj55-q5g2 |
| Go | github.com/hashicorp/vault | 1.5.4 | GO-2024-2514 |
Affected products (as reported)
References
- https://www.hashicorp.com/blog/category/vault x_refsource_MISC
- https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#154 x_refsource_CONFIRM