| Package | Affected versions | Patched versions |
|---|---|---|
| vault | = 1.9.0≥ 1.4.0, < 1.7.7≥ 1.8.0, < 1.8.6 | 1.7.71.8.6 |
In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions to a kv secrets engine) to cause a panic and denial of service of the storage backend. The earliest affected version is 1.4.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free