Vulnerability · Published Sep 28, 2023 · Assigned by HashiCorp
CVE-2023-5077Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets
High 7.6
In plain English
A high-severity security flaw in Vault from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.5%top 56.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hashicorp/vault | 1.13.0 | GHSA-86c6-3g63-5w64 |
| Go | github.com/hashicorp/vault | 1.13.0 | GO-2023-2088 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Vault | 0.10.0 – before 1.13.0 |
| HashiCorp | Vault Enterprise | 0.10.0 – before 1.13.0 |
Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H