HashiCorp HashiCorp

stack.watch can notify you when security vulnerabilities are reported in any HashiCorp product. You can add multiple products that you use with HashiCorp to create your own personal software stack watcher.

Products by HashiCorp Sorted by Most Security Vulnerabilities since 2018

HashiCorp Consul10 vulnerabilities

HashiCorp Vault8 vulnerabilities

HashiCorp Nomad4 vulnerabilities

HashiCorp Terraform2 vulnerabilities

HashiCorp Sentinel1 vulnerability

HashiCorp Packer1 vulnerability

@HashiCorp Tweets

Join HashiCorp + @ciscoDC for an upcoming webinar where we will show how Cisco #ACI, HashiCorp #Consul and Consul-T… https://t.co/i7r5q7ytGH
Wed Dec 02 23:30:07 +0000 2020

In this blog, HashiCorp partner @cloudsmith highlights how you can use the Cloudsmith #Terraform Provider to provis… https://t.co/wj0FwXwIjO
Wed Dec 02 23:11:01 +0000 2020

Terraform 0.14 is now in General Availability. Learn more about concise diff, provider dependency lockfile, and mor… https://t.co/nbchZqNFE8
Wed Dec 02 22:39:16 +0000 2020

Tomorrow kicks off more than two weeks of HashiCorp-hosted #AWS #reInvent deep dives. @joatmon08 & @tracypholmes wi… https://t.co/BFbf4movuB
Wed Dec 02 21:15:12 +0000 2020

In this #HashiConf recording @mitchellh introduces and demos one of our newest open source projects, HashiCorp Way… https://t.co/tKbRT9AYQB
Wed Dec 02 19:55:08 +0000 2020

By the Year

In 2020 there have been 17 vulnerabilities in HashiCorp with an average score of 7.6 out of ten. Last year HashiCorp had 5 security vulnerabilities published. That is, 12 more vulnerabilities have already been reported in 2020 as compared to last year. Last year, the average CVE base score was greater by 0.44

Year Vulnerabilities Average Score
2020 17 7.62
2019 5 8.06
2018 4 7.28

It may take a day or so for new HashiCorp vulnerabilities to show up. Additionally vulnerabilities may be tagged under a different product or component name.

Latest HashiCorp Security Vulnerabilities

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer

CVE-2020-16250 9.8 - Critical - August 26, 2020

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

CVE-2020-16250 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulneraility has a high impact to the confidentiality, integrity and availability of this component.

authentification

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer

CVE-2020-16251 9.8 - Critical - August 26, 2020

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

CVE-2020-16251 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulneraility has a high impact to the confidentiality, integrity and availability of this component.

authentification

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry

CVE-2020-12758 7.5 - High - June 11, 2020

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4.

CVE-2020-12758 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Improper Resource Shutdown or Release

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers

CVE-2020-12797 5.3 - Medium - June 11, 2020

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.

CVE-2020-12797 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.

Incorrect Permission Assignment for Critical Resource

HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center

CVE-2020-13170 7.5 - High - June 11, 2020

HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.

CVE-2020-13170 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Improper Input Validation

HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature

CVE-2020-13250 7.5 - High - June 11, 2020

HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.

CVE-2020-13250 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Memory Corruption

HashiCorp Vault and Vault Enterprise before 1.3.6

CVE-2020-13223 7.5 - High - June 10, 2020

HashiCorp Vault and Vault Enterprise before 1.3.6, and 1.4.2 before 1.4.2, insert Sensitive Information into a Log File.

CVE-2020-13223 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Information Leak

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 has Incorrect Access Control.

CVE-2020-12757 9.8 - Critical - June 10, 2020

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 has Incorrect Access Control.

CVE-2020-12757 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulneraility has a high impact to the confidentiality, integrity and availability of this component.

Improper Privilege Management

HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such

CVE-2020-10944 5.4 - Medium - April 28, 2020

HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload could cause arbitrary JavaScript to execute in the web UI. Fixed in 0.10.5.

CVE-2020-10944 is exploitable with network access, requires user interaction and a small amount of user privledges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.3 out of four. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

XSS

HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may

CVE-2020-10660 5.3 - Medium - March 23, 2020

HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.

CVE-2020-10660 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.

Incorrect Default Permissions

HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may

CVE-2020-10661 9.1 - Critical - March 23, 2020

HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.

CVE-2020-10661 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions

CVE-2019-19879 7.5 - High - February 14, 2020

HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. Fixed in 0.10.2.

CVE-2019-19879 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services

CVE-2020-7219 7.5 - High - January 31, 2020

HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3.

CVE-2020-7219 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Uncontrolled Resource Consumption ('Resource Exhaustion')

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints

CVE-2020-7955 5.3 - Medium - January 31, 2020

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.

CVE-2020-7955 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.

Information Leak

HashiCorp Nomad and Nomad Enterprise before 0.10.3

CVE-2020-7218 7.5 - High - January 31, 2020

HashiCorp Nomad and Nomad Enterprise before 0.10.3 allow unbounded resource usage.

CVE-2020-7218 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Uncontrolled Resource Consumption ('Resource Exhaustion')

HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC

CVE-2020-7956 9.8 - Critical - January 31, 2020

HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3.

CVE-2020-7956 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulneraility has a high impact to the confidentiality, integrity and availability of this component.

Improper Certificate Validation

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails

CVE-2020-7220 7.5 - High - January 23, 2020

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.

CVE-2020-7220 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Information Leak

When using the Azure backend with a shared access signature (SAS)

CVE-2019-19316 7.5 - High - December 02, 2019

When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.

CVE-2019-19316 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Use of a Broken or Risky Cryptographic Algorithm

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control

CVE-2019-12618 9.8 - Critical - August 12, 2019

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver.

CVE-2019-12618 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulneraility has a high impact to the confidentiality, integrity and availability of this component.

Improper Privilege Management

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control

CVE-2019-12291 7.5 - High - June 06, 2019

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.

CVE-2019-12291 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication

CVE-2019-9764 7.4 - High - March 26, 2019

HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.

CVE-2019-9764 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is consided to have a high level of attack complexity. It has an exploitability score of 2.2 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Origin Validation Error

HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3

CVE-2019-8336 8.1 - High - March 05, 2019

HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "<hidden>" as its secret is used in unusual circumstances.

CVE-2019-8336 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is consided to have a high level of attack complexity. It has an exploitability score of 2.2 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication

CVE-2018-19653 5.9 - Medium - December 09, 2018

HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.

CVE-2018-19653 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is consided to have a high level of attack complexity. It has an exploitability score of 2.2 out of four. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Cryptographic Issues

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes

CVE-2018-19786 8.1 - High - December 05, 2018

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported.

CVE-2018-19786 is exploitable with network access, and does not require authorization privledges or user interaction. This vulnerability is consided to have a high level of attack complexity. It has an exploitability score of 2.2 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

Information Exposure Through Log Files

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images

CVE-2018-15869 5.3 - Medium - August 25, 2018

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

CVE-2018-15869 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.

Incorrect Permission Assignment for Critical Resource

aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account

CVE-2018-9057 9.8 - Critical - March 27, 2018

aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.

CVE-2018-9057 can be explotited with network access, and does not require authorization privledges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulneraility has a high impact to the confidentiality, integrity and availability of this component.

Insufficient Entropy in PRNG

Built by Foundeo Inc., with data from the National Vulnerability Database (NVD), Icons by Icons8