Vulnerability · Published Jun 3, 2021 · Assigned by mitre
CVE-2021-32923
High 7.4
In plain English
A high-severity security flaw in the github.com/hashicorp/vault package (Go). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.4High
Exploit odds (30 days)1.4%top 27.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hashicorp/vault | 1.7.2 | GHSA-38j9-7pp9-2hjw |
| Go | github.com/hashicorp/vault | 1.6.5 | GHSA-38j9-7pp9-2hjw |
| Go | github.com/hashicorp/vault | 1.5.9 | GHSA-38j9-7pp9-2hjw |
| Go | github.com/hashicorp/vault | 1.5.9, 1.6.5, 1.7.2 | GO-2022-0623 |
Affected products (as reported)
References
- https://www.hashicorp.com/blog/category/vault/ x_refsource_MISC
- https://discuss.hashicorp.com/t/hcsec-2021-15-vault-renewed-nearly-expired-leases-with-incorrect-non-expiring-ttls/24603 x_refsource_MISC
- GLSA-202207-01 vendor-advisory, x_refsource_GENTOO