Improper Input Validation in HashiCorp Vault

严重 9.8CVE-2020-12757 · BIT-vault-2020-12757 · GHSA-75pc-qvwc-jf3g · Published 10/06/2020 · updated 17/06/2026

要点

CVE-2020-12757 是影响 github.com/hashicorp/vault-plugin-secrets-gcp, vault (hashicorp) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：1.6%，高于 75.2% 的漏洞。
修复：升级到 0.6.2, 1.4.2 或更高版本。

Package	Affected versions	Patched versions
github.com/hashicorp/vault-plugin-secrets-gcp Go	`< 0.6.2`	`0.6.2`
vault hashicorp	`≥ 1.4.0, < 1.4.2`	`1.4.2`

Description

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 in Go package github.com/hashicorp/vault-plugin-secrets-gcp/plugin has Incorrect Access Control.

NVD description

HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.

References

nvd.nist.gov/vuln/detail/CVE-2020-12757 · ADVISORY
hashicorp/vault-plugin-secrets-gcp#85 · WEB
hashicorp/vault-plugin-secrets-gcp commit e43d208 · WEB
hashicorp/vault · WEB
hashicorp/vault · WEB
hashicorp.com/blog/category/vault · WEB
hashicorp.com/blog/category/vault · Vendor Advisory
GitHub Advisory GHSA-75pc-qvwc-jf3g · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free