HashiCorp Vault's PKI mount vulnerable to denial of service

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2023-0665 · ADVISORY
• discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1 · WEB
• hashicorp/vault · PACKAGE
• security.netapp.com/advisory/ntap-20230526-0008 · WEB
• security.netapp.com/advisory/ntap-20230526-0008
• GitHub Advisory GHSA-hwc3-3qh6-r4gg · ADVISORY

Lỗ hổng khác của github.com/hashicorp/vault

• CVE-2026-5807CAO 7.5Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generati…
• CVE-2026-5052CAO 8.6Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these re…
• CVE-2026-4525CAO 8.8If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Va…
• CVE-2026-3605CAO 8.1An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized t…
• CVE-2025-12044CAO 7.5Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due t…