| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/hashicorp/vault | ≥ 1.8.0, < 1.8.4< 1.7.5 | 1.8.41.7.5 |
| vault | ≥ 1.8.0, < 1.8.4< 1.7.5 | 1.8.41.7.5 |
HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free