Improper Input Validation in vault-ssh-helper

高 7.5CVE-2020-24359 · GHSA-f9fq-vjvh-779p · GO-2022-0824 · 20/08/2020 公開 · 17/06/2026 更新

要点

CVE-2020-24359 は github.com/hashicorp/vault-ssh-helper, vault-ssh-helper (hashicorp) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.0%（全脆弱性の 63.9% より高い）。
対処：0.2.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/hashicorp/vault-ssh-helper Go	`< 0.2.0`	`0.2.0`
vault-ssh-helper hashicorp	`< 0.2.0`	`0.2.0`

概要

HashiCorp vault-ssh-helper (github.com/hashicorp/vault-ssh-helper/helper) up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0.

NVD の説明

HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0.