| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/hashicorp/vault | ≥ 1.13.0, < 1.20.1 | 1.20.1 |
| vault | = 1.20.0≥ 1.13.0, < 1.16.23≥ 1.13.0, < 1.20.1≥ 1.17.0, < 1.18.12≥ 1.19.0, < 1.19.7 | 1.16.231.20.11.18.121.19.7 |
Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free