Improper Input Validation in HashiCorp Vault

CRÍTICO 9.8CVE-2020-12757 · BIT-vault-2020-12757 · GHSA-75pc-qvwc-jf3g · Published 10/06/2020 · updated 17/06/2026

En resumen

CVE-2020-12757 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a github.com/hashicorp/vault-plugin-secrets-gcp, vault (hashicorp).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.6%, mayor que el 75.2% de las vulnerabilidades.
Solución: actualizar a 0.6.2, 1.4.2 o posterior.

Package	Affected versions	Patched versions
github.com/hashicorp/vault-plugin-secrets-gcp Go	`< 0.6.2`	`0.6.2`
vault hashicorp	`≥ 1.4.0, < 1.4.2`	`1.4.2`

Description

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control.

NVD description

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.

References

nvd.nist.gov/vuln/detail/CVE-2020-12757 · ADVISORY
hashicorp/vault-plugin-secrets-gcp#85 · WEB
hashicorp/vault-plugin-secrets-gcp commit e43d208 · WEB
hashicorp/vault · WEB
hashicorp/vault · WEB
hashicorp.com/blog/category/vault · WEB
hashicorp.com/blog/category/vault · Vendor Advisory
GitHub Advisory GHSA-75pc-qvwc-jf3g · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/hashicorp/vault-plugin-secrets-gcp

< 0.6.2

0.6.2

vault

hashicorp

≥ 1.4.0, < 1.4.2

1.4.2

Description

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control.

NVD description