HashiCorp HashiCorp

Do you want an email whenever new security vulnerabilities are reported in any HashiCorp product?

Products by HashiCorp Sorted by Most Security Vulnerabilities since 2018

HashiCorp Vault23 vulnerabilities

HashiCorp Consul19 vulnerabilities

HashiCorp Nomad10 vulnerabilities

HashiCorp Terraform3 vulnerabilities

HashiCorp Go Slug1 vulnerability

HashiCorp Packer1 vulnerability

HashiCorp Sentinel1 vulnerability

HashiCorp Vault Action1 vulnerability

@HashiCorp Tweets

Get an update from @phinze on the latest features in Terraform open source and the commercial versions, along with… https://t.co/zbKO9fPerZ
Sat Oct 23 17:00:27 +0000 2021

If you're interested in Zero Trust Security and Zero Trust Networking, but not sure where to begin, check out this… https://t.co/c6B2HInQq6
Fri Oct 22 18:11:04 +0000 2021

New this week on the HashiCorp Learn platform: track your progress as you study for a HashiCorp Certification or le… https://t.co/iUIcWrsHyb
Fri Oct 22 16:49:04 +0000 2021

HashiCorp #Vault has surpassed 100 integrations, including @traefik Enterprise, which supports Vault as a key-value… https://t.co/Mbb3zwpKvQ
Thu Oct 21 19:15:05 +0000 2021

How do you select the right tech stack? @psomal discussed everything from evaluating vendors to choosing open sourc… https://t.co/Qen1cnvY1T
Thu Oct 21 16:53:02 +0000 2021

By the Year

In 2021 there have been 28 vulnerabilities in HashiCorp with an average score of 7.1 out of ten. Last year HashiCorp had 27 security vulnerabilities published. That is, 1 more vulnerability have already been reported in 2021 as compared to last year. Last year, the average CVE base score was greater by 0.45

Year Vulnerabilities Average Score
2021 28 7.10
2020 27 7.54
2019 5 8.06
2018 4 7.28

It may take a day or so for new HashiCorp vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent HashiCorp Security Vulnerabilities

HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine

CVE-2021-42135 8.1 - High - October 11, 2021

HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.

AuthZ

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3

CVE-2021-41802 5.4 - Medium - October 08, 2021

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other users policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.

Incorrect Permission Assignment for Critical Resource

HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5

CVE-2021-41865 6.5 - Medium - October 07, 2021

HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5 allowed authenticated users with job submission capabilities to cause denial of service by submitting incomplete job specifications with a Consul mesh gateway and host networking mode. Fixed in 1.1.6.

HashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint

CVE-2021-40862 8.8 - High - September 15, 2021

HashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint that erroneously disclosed a sensitive URL to authenticated parties, which could be used for privilege escalation or unauthorized modification of a Terraform configuration. Fixed in v202109-1.

Exposure of Resource to Wrong Sphere

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint

CVE-2021-38698 6.5 - Medium - September 07, 2021

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.

AuthZ

HashiCorp Nomad and Nomad Enterprise Raft RPC layer

CVE-2021-37218 8.8 - High - September 07, 2021

HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.

Improper Certificate Validation

HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer

CVE-2021-37219 8.8 - High - September 07, 2021

HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.

Improper Certificate Validation

HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication

CVE-2021-27668 5.3 - Medium - August 31, 2021

HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.

authentification

HashiCorp Vault and Vault Enterprises UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser

CVE-2021-38554 5.3 - Medium - August 13, 2021

HashiCorp Vault and Vault Enterprises UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.

Improper Removal of Sensitive Information Before Storage or Transfer

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions

CVE-2021-38553 4.4 - Medium - August 13, 2021

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.

Improper Preservation of Permissions

HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token

CVE-2021-36230 8.8 - High - July 20, 2021

HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token, allowing privilege escalation to organization owner. Fixed in v202107-1.

AuthZ

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name

CVE-2021-32574 7.5 - High - July 17, 2021

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.

Improper Certificate Validation

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open

CVE-2021-36213 7.5 - High - July 17, 2021

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1.

HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode

CVE-2021-32575 6.5 - Medium - June 17, 2021

HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.

HashiCorp Vault and Vault Enterprise

CVE-2021-32923 7.4 - High - June 03, 2021

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.

Insufficient Session Expiration

HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0

CVE-2021-32074 7.5 - High - May 07, 2021

HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.

Insertion of Sensitive Information into Log File

HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra clusters

CVE-2021-27400 7.5 - High - April 22, 2021

HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1

Improper Certificate Validation

HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates

CVE-2021-29653 7.5 - High - April 22, 2021

HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8, 1.6.4, and 1.7.1.

Improper Certificate Validation

HashiCorp Terraforms Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Vaults GCP auth method

CVE-2021-30476 9.8 - Critical - April 22, 2021

HashiCorp Terraforms Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Vaults GCP auth method. Fixed in 2.19.1.

HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting

CVE-2020-25864 6.1 - Medium - April 20, 2021

HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.

XSS

HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events

CVE-2021-28156 7.5 - High - April 20, 2021

HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10.

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting

CVE-2021-3153 6.5 - Medium - March 26, 2021

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1.

AuthZ

HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid

CVE-2021-3024 5.3 - Medium - February 01, 2021

HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.

HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers

CVE-2021-3283 7.5 - High - February 01, 2021

HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.

HashiCorp Vault Enterprise 1.6.0 & 1.6.1

CVE-2021-3282 7.5 - High - February 01, 2021

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

authentification

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests

CVE-2020-25594 5.3 - Medium - February 01, 2021

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0

CVE-2020-8567 6.5 - Medium - January 21, 2021

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.

Directory traversal

An issue was discovered in GoGo Protobuf before 1.3.2

CVE-2021-3121 8.6 - High - January 11, 2021

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

out-of-bounds array index

HashiCorp Vault Enterprises Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces

CVE-2020-35453 5.3 - Medium - December 17, 2020

HashiCorp Vault Enterprises Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. Fixed in 1.5.6 and 1.6.1.

Improper Input Validation

HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method

CVE-2020-35177 5.3 - Medium - December 17, 2020

HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

Information Disclosure

The official vault docker images before 0.11.6 contain a blank password for a root user

CVE-2020-35192 9.8 - Critical - December 17, 2020

The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.

Missing Authentication for Critical Function

The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user

CVE-2020-29564 9.8 - Critical - December 08, 2020

The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password.

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives

CVE-2020-29529 7.5 - High - December 03, 2020

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.

insecure temporary file

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type

CVE-2020-28348 6.5 - Medium - November 24, 2020

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.

Directory traversal

HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5

CVE-2020-28053 6.5 - Medium - November 23, 2020

HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.

Incorrect Permission Assignment for Critical Resource

HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service

CVE-2020-25201 7.5 - High - November 04, 2020

HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5.

Excessive Iteration

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature

CVE-2020-27195 9.1 - Critical - October 22, 2020

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6

HashiCorp Vault and Vault Enterprise versions 1.0 and newer

CVE-2020-25816 6.8 - Medium - September 30, 2020

HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer

CVE-2020-16251 9.8 - Critical - August 26, 2020

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

authentification

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer

CVE-2020-16250 9.8 - Critical - August 26, 2020

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

authentification

HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature

CVE-2020-13250 7.5 - High - June 11, 2020

HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.

Buffer Overflow

HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center

CVE-2020-13170 7.5 - High - June 11, 2020

HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.

Improper Input Validation

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers

CVE-2020-12797 5.3 - Medium - June 11, 2020

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.

Incorrect Permission Assignment for Critical Resource

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry

CVE-2020-12758 7.5 - High - June 11, 2020

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4.

Improper Resource Shutdown or Release

HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials

CVE-2020-13223 7.5 - High - June 10, 2020

HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2.

Information Disclosure

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1

CVE-2020-12757 9.8 - Critical - June 10, 2020

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.

Improper Privilege Management

HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such

CVE-2020-10944 5.4 - Medium - April 28, 2020

HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload could cause arbitrary JavaScript to execute in the web UI. Fixed in 0.10.5.

XSS

HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may

CVE-2020-10661 9.1 - Critical - March 23, 2020

HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.

HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may

CVE-2020-10660 5.3 - Medium - March 23, 2020

HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.

Incorrect Default Permissions

HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions

CVE-2019-19879 7.5 - High - February 14, 2020

HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. Fixed in 0.10.2.

HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC

CVE-2020-7956 9.8 - Critical - January 31, 2020

HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3.

Improper Certificate Validation

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints

CVE-2020-7955 5.3 - Medium - January 31, 2020

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.

Information Disclosure

HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services

CVE-2020-7219 7.5 - High - January 31, 2020

HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3.

Resource Exhaustion

HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services

CVE-2020-7218 7.5 - High - January 31, 2020

HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 0.10.3.

Resource Exhaustion

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails

CVE-2020-7220 7.5 - High - January 23, 2020

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.

Information Disclosure

When using the Azure backend with a shared access signature (SAS)

CVE-2019-19316 7.5 - High - December 02, 2019

When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.

Use of a Broken or Risky Cryptographic Algorithm

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control

CVE-2019-12618 9.8 - Critical - August 12, 2019

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver.

Improper Privilege Management

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control

CVE-2019-12291 7.5 - High - June 06, 2019

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.

HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication

CVE-2019-9764 7.4 - High - March 26, 2019

HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.

Origin Validation Error

HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3

CVE-2019-8336 8.1 - High - March 05, 2019

HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "<hidden>" as its secret is used in unusual circumstances.

HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication

CVE-2018-19653 5.9 - Medium - December 09, 2018

HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.

Cryptographic Issues

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes

CVE-2018-19786 8.1 - High - December 05, 2018

HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported.

Insertion of Sensitive Information into Log File

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images

CVE-2018-15869 5.3 - Medium - August 25, 2018

An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source software per AWS recommended security best practices, may unintentionally load an undesired and potentially malicious Amazon Machine Image (AMI) from the uncurated public community AMI catalog.

Incorrect Permission Assignment for Critical Resource

aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account

CVE-2018-9057 9.8 - Critical - March 27, 2018

aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password.

Insufficient Entropy in PRNG

Built by Foundeo Inc., with data from the National Vulnerability Database (NVD), Icons by Icons8. Privacy Policy. Use of this site is governed by the Legal Terms
Disclaimer
CONTENT ON THIS WEBSITE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. Always check with your vendor for the most up to date, and accurate information.