En resumen
- CVE-2025-3879 es una vulnerabilidad ALTO (CVSS 8.8) que afecta a github.com/hashicorp/vault, vault (hashicorp).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.44%, mayor que el 38.1% de las vulnerabilidades.
- Solución: actualizar a 1.19.1, 1.16.18, 1.17.14, 1.18.7 o posterior.
| Package | Affected versions | Patched versions |
|---|
| github.com/hashicorp/vault Go | ≥ 1.10.0, < 1.19.1
| 1.19.1
|
| vault | = 1.19.0≥ 0.10.0, < 1.16.18≥ 0.10.0, < 1.19.1≥ 1.17.0, < 1.17.14≥ 1.18.0, < 1.18.7
| 1.16.181.19.11.17.141.18.7
|
Description
Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.
NVD description
Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.
Más vulnerabilidades de github.com/hashicorp/vault
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free