| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/hashicorp/vault | ≥ 0.11.0, < 1.7.6≥ 1.8.0, < 1.8.5 | 1.7.61.8.5 |
| vault | = 1.8.4≥ 0.11.0, ≤ 1.7.5 |
HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free