Vulnerability · Published Mar 30, 2023 · Assigned by HashiCorp
CVE-2023-0665Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata
Medium 6.5
In plain English
A medium-severity security flaw in Vault from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hashicorp/vault | 1.11.9 | GHSA-hwc3-3qh6-r4gg |
| Go | github.com/hashicorp/vault | 1.12.5 | GHSA-hwc3-3qh6-r4gg |
| Go | github.com/hashicorp/vault | 1.13.1 | GHSA-hwc3-3qh6-r4gg |
| Go | github.com/hashicorp/vault | 1.11.9, 1.12.5, 1.13.1 | GO-2023-1708 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Vault | 1.13.0 – before 1.13.11.12.0 – before 1.12.51.11.0 – before 1.11.9 |
| HashiCorp | Vault Enterprise | 1.13.0 – before 1.13.11.12.0 – before 1.12.51.11.0 – before 1.11.9 |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L