Improper Input Validation in HashiCorp Vault

CRÍTICO 9.8CVE-2020-12757 · BIT-vault-2020-12757 · GHSA-75pc-qvwc-jf3g · Published 10/06/2020 · updated 17/06/2026

Em resumo

CVE-2020-12757 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta github.com/hashicorp/vault-plugin-secrets-gcp, vault (hashicorp).
Chance de exploração nos próximos 30 dias (EPSS): 1.6%, maior que 75.2% das vulnerabilidades.
Correção: atualize para 0.6.2, 1.4.2 ou posterior.

Package	Affected versions	Patched versions
github.com/hashicorp/vault-plugin-secrets-gcp Go	`< 0.6.2`	`0.6.2`
vault hashicorp	`≥ 1.4.0, < 1.4.2`	`1.4.2`

Description

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control.

NVD description

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.

References

nvd.nist.gov/vuln/detail/CVE-2020-12757 · ADVISORY
hashicorp/vault-plugin-secrets-gcp#85 · WEB
hashicorp/vault-plugin-secrets-gcp commit e43d208 · WEB
hashicorp/vault · WEB
hashicorp/vault · WEB
hashicorp.com/blog/category/vault · WEB
hashicorp.com/blog/category/vault · Vendor Advisory
GitHub Advisory GHSA-75pc-qvwc-jf3g · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/hashicorp/vault-plugin-secrets-gcp

< 0.6.2

0.6.2

vault

hashicorp

≥ 1.4.0, < 1.4.2

1.4.2

Description

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control.

NVD description