| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/hashicorp/vault | ≥ 0.8.0, < 1.20.1 | 1.20.1 |
| vault | = 1.20.0≥ 0.8.0, < 1.16.23≥ 0.8.0, < 1.20.1≥ 1.17.0, < 1.18.12≥ 1.19.0, < 1.19.7 | 1.16.231.20.11.18.121.19.7 |
A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’s configuration. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free