Improper Authentication in HashiCorp Vault

ALTO 7.5CVE-2021-3282 · BIT-vault-2021-3282 · GHSA-rq95-xf66-j689 · Published 01/02/2021 · updated 17/06/2026

In breve

CVE-2021-3282 è una vulnerabilità ALTO (CVSS 7.5) che riguarda github.com/hashicorp/vault, vault (hashicorp).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.3%, superiore al 70.8% delle vulnerabilità.
Correzione: aggiornare a 1.6.2 o successiva.

Package	Affected versions	Patched versions
github.com/hashicorp/vault Go	`≥ 1.6.0, < 1.6.2`	`1.6.2`
vault hashicorp	`= 1.6.0= 1.6.1`	No fix yet

Description

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

NVD description

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

References

nvd.nist.gov/vuln/detail/CVE-2021-3282 · ADVISORY
hashicorp/vault commit 09f9068 · WEB
discuss.hashicorp.com/t/hcsec-2021-04-vault-enterprise-s-dr-secondaries-allowed-raft-peer-removal-without-authentication/20337 · WEB
security.gentoo.org/glsa/202207-01 · WEB
GitHub Advisory GHSA-rq95-xf66-j689 · ADVISORY

Altre vulnerabilità di github.com/hashicorp/vault

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/hashicorp/vault

≥ 1.6.0, < 1.6.2

1.6.2

vault

hashicorp

= 1.6.0= 1.6.1

No fix yet

Description

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

NVD description

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.

Altre vulnerabilità di github.com/hashicorp/vault

Vedi tutto →