Improper Resource Shutdown or Release in HashiCorp Vault

ALTO 7.5CVE-2020-7220 · BIT-vault-2020-7220 · GHSA-9vh5-r4qw-v3vv · Published 23/01/2020 · updated 17/06/2026

En resumen

CVE-2020-7220 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a github.com/hashicorp/vault, vault (hashicorp).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.4%, mayor que el 72.9% de las vulnerabilidades.
Solución: actualizar a 1.3.2 o posterior.

Package	Affected versions	Patched versions
github.com/hashicorp/vault Go	`≥ 0.11.0, < 1.3.2`	`1.3.2`
vault hashicorp	`≥ 0.11.0, < 1.3.2`	`1.3.2`

Description

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.

NVD description

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.

References

nvd.nist.gov/vuln/detail/CVE-2020-7220 · ADVISORY
hashicorp/vault · WEB
hashicorp.com/blog/category/vault · WEB
hashicorp.com/blog/category/vault · Vendor Advisory
GitHub Advisory GHSA-9vh5-r4qw-v3vv · ADVISORY

Más vulnerabilidades de github.com/hashicorp/vault

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/hashicorp/vault

≥ 0.11.0, < 1.3.2

1.3.2

vault

hashicorp

≥ 0.11.0, < 1.3.2

1.3.2

Description

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.

NVD description

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.

Más vulnerabilidades de github.com/hashicorp/vault

Ver todo →