GHSA-hwc3-3qh6-r4gg

ghsaUSosv

HashiCorp Vault's PKI mount vulnerable to denial of service

view advisory published 2023-03-30Licence: CC-BY-4.0

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-0665US	medium6.5	0.33% (26th)	—	2023-03-30
HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1WEB
https://github.com/hashicorp/vaultPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2023-0665ADVISORY
https://security.netapp.com/advisory/ntap-20230526-0008WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan